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P REFACE 


Section I provides a summary of the Panel's observations 
and conclusions on the Space Shuttle Program. 

Section IX summarizes the information developed during the 
Panel's inspection activities since our last report on the 
Shuttle program. The criteria for inclusion of information 
in this volume is its relevance for a safe and successful 
mission. This section is organized in a manner that points 
up the management areas and the individual elements of the 
Shuttle system providing a summary of the basic management 
or design approach including the most obvious limits or 
hazards that are significant to crew safety. It also provides 
the status of the situation with particular attention to the 
current resolution of those hazards. 

We hope the report will be of assistance to those in the 
Shuttle Program as a checklist to assure that the right questions 
continue to be asked at the right time. But the report is also 
written ior a larger readership to assist them in understanding 
this complex program and its more salient details. 


ill 
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1.0 INTRODUCTION 


1.1 Purpose 

This section, Section II, provides a summary of the information 
developed during our inspection activities and in a detailed review 
of documentation used in the Space Shuttle program. Its intent is 
to provide the reader with an idea of the data examined by the Panel 
and a description of the program at this time. Another purpose is to 
provide specific background information and supporting details to 
augment the data provided in "Section I - Panel's Observations and 
Conclusions." In addition this material will be utilized by the Panel 
in further reviews during the coming year as a baseline and reference 
manua 1 . 

1.2 Scope 

The structure of this volume follows the basic organization of 
Section I. It extends the coverage of the Shuttle elements to include 
those specific subsystems considered critical to crew safety. This 
volume also discusses such technical management areas as systems 
integration test program planning. It also covers such specific crew 
safety areas as the Orbiter Thermal Protection System, safety and re- 
liahilitv efforts on so-called secondary structure, and lightning 
protection. Such a compilation of data is necessarily a compro- 
mise between detail and brevity and this accounts for the numerous 
figures and tables used in this volume. 
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2 *0 SHUTTLE PROGRAM MANAGEMENT 


2 • 1 Technic al Management: System 

A management overview was provided in the Panel's annual report 
dated March 1974. The material provided at that time is still valid 
and need not be repeated here. Our emphasis has been on those aspects 
of technical management that support and control Shuttle requirements 
and design, hazard identification, resolution or acceptance of risks, 
and the safety implications of test planning. With this in mind the 
Panel focused on the following specific areas: (1) the review system 

to establish and assure implementation of design requirements and 
concepts, (2) management of the development of the Orbiter Thermal 
Protection System and Space Shuttle Main Engine Electronic Controller, (3) 
integration management applied to the element interfaces and the. risk 
management itself, and (4) special management approaches developed to 
meet special program needs. To maintain the brevity of this report only 
the key data developed by the Panel are presented here. 

Orbiter Therma l Protection System 


Management of the Orbiter Thermal Protection System (TPS) within 
the total Shuttle system framework must account for the many tech- 
nical and scientific disciplines and interfaces which affect the re- 
quirements, design, fabrication and verification of the operational 
hardware. The disciplines and interfaces, or elements, of TPS manage- 
ment include the following: 
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O Disciplines 

o Aerodynamics md Plight Mechanics 
o Heat Transfer and Fluid Mechanics 
o Structural design 
o Materials 
o Structural Dynamics 

o Testing and Environmental Simulation 


o Interfaces 

o Structures 
o Mission Design 
o Mechanical Systems 
0 Thermal Control Systems 


o Ground Support Equipment 
o Prime and Subcontractors 
o NASA Element Organizations 
o Flight/Ground Test 0. flees 


o Propulsion Systems 


o Flight Operations 


Thus development of the TPS requites a multi-faceted NASA/Contractor 
management and technical organisation. The TPS. as e part of the 
Orbttcr. Calls under the direction of JSC In the manner shove. In 
figure 1, "JSC TPS Management Organization" and in Figure 2, "JSC TPS 
Management Organization Detail.” Overall management la under the 
direction and control of the Orbltet Project Manager (Level III) 
through the Orbiter engineering Oflice. Day-to-day technle.l manage- 
ment is through two divisions of the Engineering end Development 
Directorate - Engineering and Analysis Division and the Structure 


ami Mechanics Division. 
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All of these operations are integrated and directed by the TPS 
Manager who is within the Structures and Mechanics Division of the 
Engineering and Development Directorate. The prime contractor for the 
TPS is the Rockwell International Corporation who also is the prime 
contractor for the Orbiter vehicle, Rockwell International has, in 
turn, subcontracted the development and production of the TPS tiles 
to the Lockheed Missiles and Space Company, Space Systems Division at 
Sunnyvale, California. NASA has, at the same time, arranged with 

their own Ames Research Center and Langley Research Center for tech- 
nical support. 

The NASA roles in TPS development are shown below: 
o Johnson Space Center 

o Requirements definition 
o Management of the Prime Contractor 
o Integration of Technology 
o Testing and Assessment of the System 
o Overall Test Program Management 
o Test Facility Development 
o Ames Research Center and Langley Research Center 

o Development of New Technology (including Material 
Characterization) 
o Development of Test facility 
o Technical Review and Consul tat ion 
o Testing and Evaluation 
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Tht' Contractor rales have been described as follows: 
o Rockwell International 

Design of the TPS high and low temperature systems 
o Conduct of all thermos true tural analyses on Orbiter 
o Perform TPS subsystem qualification testing 
o Provide detail drawings and other required documentation 
(procurement specification defining performance re- 
quirements, statement of work defining tasks, de- 
fine quantity and schedule, and subcontractor change 
notices) 

o Administer Subcontractor and materials procurement 
o Conduct of periodic reviews to assure proper conduct 
of TPS program 

o Define and implement installation and maintenance 
operations, including refurbishment and replacement 
at launch site 

o Lockheed Missiles and Space Co. 

o Develop and optimize coated tiles 

o Provide material property data on tiles and coating 
o Demonstrate compatibility between tiles and coating 
o Fabricate, acceptance test and deliver subsystem elements 
The Preliminary IX'si ; .n Reviews conducted to date on Orbiters 101 
ml 1.0:? and the Space Shut tle System have not fully covered the 
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Qrbiter TPS. A detailed review is expected in mid-year 1975 to assess 
whether the TPS design and Implementation meets Shuttle requirements. 
2.1.2 Space Shuttle Main Engine Controller 

The 5SME Controller for each engine in conjunction with the 
flight control system monitors and controls the three Main Engines 
during the ascent portion of the Shuttle mission. The Controller 
also develops data on engine parameters that are used during the 
ground servicing cycle. The Controller depends on comparatively new 
technology and has a varied development history starting with the 
Viking program. As the result a management system has had to be 
developed conmensurate with the technical disciplines, Shuttle inter- 
faces, product quality assurance requirements and attendant management 
visibility needed to meet the demands placed upon this critical sub- 
system. 

Marshall Space Flight Center (MSFC) is responsible for the de- 
sign and development of the Space Shuttle Main Engine. The Rocketdyne 
Division of the Rockwell International Corporation is the prime con- 
tractor for the SSME and they in turn have a subcontract with Honeywell, 
Inc. for the design, fabrication, and validation of the SSME-Controller. 

To summarize briefly, management and hardware development history 
of the Controller has not been a smooth road. Approach to the de- 
sign itself was not conventional and therefore a large history/data 
base did not exist. As a matter of fact the packaging concept and 



UfU > »>i plntcd-wire me.-.mry contributed a great deal to the Initial 
inana gemont and technical problems. The ehallenRe was to develop a 
management team and establish a management system to assure an effective 
approach to development and produelbility and to control and resolve 
problems on a timely basis. 

Through the diligent efforts of NASA, the Rocketdyne Division 
ol Rockwell International and the Honeywell, Inc. organizations, the 
SSMK- Controller program now appears to be "on the track" at this time, 
and the management and general controller activities are said to be 
"tracking close to plan, with encouraging results." 

During this period of the Controller's evolution, the Panel 

centered on the following three questions: 

(a) Have the management lessons learned on Viking been 
systematically reviewed and the appropriate ones incorporated in the 
management system lor the Shuttle SSME Controller? This was based on 
the continuing emphasis by NASA's senior management, as well as the 
Panel, that lessons learned from prior programs be applied to on-going 
programs as appropriate. 

(b) Will the plated-wire memory concept support the re- 
quirements and schedule of the SSMK and Shuttle program? This was 
based on the knowledge that such technology represented a new and 

« ssentially high-risk technology. 

(c) based on the past history of computer development pro- 
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uramu and the known schedule and cost problems that had arisen on 
this program, what are the fundamental challenges and ability of 
the NASA/Contractor team to resolve them In an orderly and timely 
fashion? 

Specific comments on these areas examined by the Panel are pro- 
vided below and support the previous statements concerning the SSME- 
Controller status at this time. 

While the Panel found no single reporting format available which 
systematically stated the significant lessons and their disposition 
on the Shuttle program, the Honeywell Program Manager had his staff 
review the minutes and audita from the numerous Viking reviews and 
identify specific actions that could impact their operations on 
Shuttle. They then documented why those problems would not occur on 
their Shuttle project. To further enhance the management control of 
the program, the Program Manager defined a detailed work breakdown 
system and negotiated work/budge^ contracts wxth each major component 
supervisor. A problem control and resolution system was established 
which assigns action officers to each problem and monitors the solution 
as well as its timeliness. Additional technical and middle level 
supervision was added to the project. These people were drawn from 
the Martin Marietta Company and the Collins Radio Company. 

Based on the Panel's experience with Apollo and Skylab, the con- 
figuration management system appears sufficiently disciplined lor con- 
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i ml ol engineering and »<*«« drawings, »l>‘‘el Hendons, lubrication 
prnr,..l...vH f and material |»roc«.H»I.n g. Produc t ion Is essentially a 
ni.un.al bui ldup pro, ana a. the bunch. Tool, eontrol and special tools 
support tin- nv umlaut urn and (oat. of the components have boon im- 
proved and developed whore such support Is nuudod. standard process 
{mu nu t Ions and detailed fabrication layouts have boon dovolopod 
from Viking experience and with the help of MSKC to train and certify 
Slmttlo personnel. An important lesson from Viking is the slgnilicunee 
of anticipating production problems. Thus Honeywell established a 
detailed categorization of production errors so trends and corrective 
ac l ion can be identified early. All of these improvements have re- 
sulted in a higher degree of quality control and wcrlov.art. -P . 

rhu plated -wire memory design, fabrication and validation proems 
as described to the Panel indicates (1) there is adequate experience 
,o da ic with the development of the plated-wirc memory to warrant con- 
fidence at this time, ( 2 ) there does not appear to be a clear under- 
standing of the ii.ndnmei.tal physics associated with -hid type cf com- 
ponent to assure that surprises would be anticipated and a timely course 
of resolution decided upon and implemented, and (3) it additional 
development surprises did ocur, they probably could be solved by 
trial and error given sufficient time but that su=h surprises would 
probably impact the current tight schedule for the early pre-production 

runt rollers as well as costs. 
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The accomplishments of the SSME-Controller team during the past 
year have been significant but much has yet to be done. Close monitoring 
by NASA/ Contractor team must be continued to assure on-time delivery 
of properly operating units to support the SSME engine test program 
and other major orbiter/system tests prior to the first orbital test 
flight . 

Two significant problems remain at this time - Master Inter- 
connect Board wire routing/shielding in the memory area in which noise 
is being coupled into the memory sense lines due to wire routing and 
inadequate shielding and intermittent parity errors. These problems 
are discussed in more detail in later sections of this report. 

Technical management of the SSME-Controller software had some 
of the 3ame problems as found in the Controller hardware program. 
Verification testing revealed numerous errors. As a result an assess- 
ment team, composed of non-Shuttle segments of the Honeywell organi- 
zation, Rocketdyne , and NASA personnel was instituted. The following 
actions were taken as a result of the team's review: 

(a) Software efforts were strengthened by adding technical 
personnel at Honeywell along with organizational changes t.t both 
Rocketdyne and Honeywell. 

(b) Software was simplified and deliveries were phased to 
meet minimum Integrated System Test Bed (ISTB) test program needs. 

(c) Technical management changes were made so that software 
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in debugged prior to release for verification runs. Daily schedules 
ami audits are used to assure knowledgeable management control. "Mem- 
ory scrub groups" at Honeywell and Rocketdyne have been established to 
update and assure software compatibility. Such changes have enhanced 
the Honeywell planning efforts and contribute to a proper balance be- 
tween those personnel developing the software itself and those doing 
the software verification. 

2,1.2 Integration Management 

One key to the proper allocation of resources to the total Space 
Shuttle program is the adequacy of the Space Shuttle element inte- 
gration effort. This is an activity conducted by the JSC program 
office with the direct support of the Rockwell International Corpor- 
ation, Space Division. All other NASA Centers and Prime Contractors 
involved in the Shuttle program contribute as appropriate. The ultimate 
responsibility for Integrating the total Shuttle program is NASA's, but 
much of the crucial work to assure the success of this effort is accom- 
plished by the System Contractor, Rockwell International. Consequently, 
the Panel asked (1) what are roles of each, (2) what tasks are being done 
by each and what work areas are not receiving sufficient emphasis, (3) 
arc there congruent expectations among Lhc many elements of the program 
regarding system integration, and (4) what is the degree of communication 
a moii' 1 . those involved and management's sensitivity to the problems inherant 
in the continuing integration etforL? 
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In its Annual Report for 1973 the Panel discussed this area and 
received a response ua shown in Section 7.3 of this volume. This 
dealt with the results of Rockwell’s effort to separate their inte- 
gration task from the Orbiter task, and with the increase in tasks 
assigned to Rockwell International as the "System Contractor." 

2. 1.3.1 NASA 

The Space Shuttle program organisation centers its integration 
effort in the Systems Integration Office within the Space Shuttle 
Program Manager’s office at JSC. This is the Level II operation and 
is also the "lead center" on the program. The responsibilities of 
this Systems Integration Office are: 

(a) Review, control and manage the systems Integration 

activities for the Shuttle program. 

(b) Manage the design, development, test and engineering 

for the Shuttle carrier aircraft project. 

The functions carried out by this office are shown in Table I. 
"Detailed Program Inter-relationships" are spelled out in the current 
issue of Volume II oL the JSC 07700 Level II program definition and 
requirements documents. 

The JSC Systems Integration Office has on-site representatives 
from Marshall Space Flight Center, Office ol Aeronautics and Space 
Technology (NASA Headquarters), JSC's Kngineering and Development 
Division, Shuttle Carrier Aircraft Project Office, and the Kennedy 
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Space Center. There are three major sub-groups In this office - Systems 
Engineering, Technical Integration, and Test and Ground Operations. 

These functions at JSC are staffed by approximately 100 Civil Service 
people (35 JSC program office, 15 co-located fropt KSC and MSFC, 50 En- 
gineering and Development). 

The necessary coordination in support of the specific tasks to 
achieve true Shuttle system integration uses many of the methods 
developed on Apollo and Skylab programs. Informal and formal channels 
are used freely, but controlled by the program and element project 
managers. The more formalized review system is a definite part of 
the integration effort as always and is discussed in a later section 

of this report. 

Of particular significance are the more than 30 formalized panels 
and working groups working on a day-to-day basis. They encompass all 
programmatic areas and are composed of NASA, contractor, and USAF 
personnel. The Panels are established as a continuous entity to cover 
specific technical and technical management regimes. Working groups 
are established to mer . a specific technical task that requires timely 
resolution and which is terminated once that problem is resolved. A 
list of the Panels and Working Groups is provided in Table II. 

Areas of coordination/integration, that tall between the Panel 
type operation and the review system, are the System Integration Re- 
views (SIR's) and the Computer System Integration Reviews (CSIR's). 
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Their purpose is to review, control, and manage the systems inte- 
gration activities. These activities include (1) integration con- 
tractor system tasks, (2) element contractor system tasks, and 
(3) NASA system tasks which are conducted at both Headquarters and 
Centers , 

Approximately every three weeks this group meets, basically 
through tele-conference methods, to take up the many systems' problems 
given to them for their resolution. As stated at a recent Preliminary 
Design Review ... "Where more clout is needed to achieve resolution of 
baseline data it goes to the Systems Integration Review Panel (SIR)." 
Here is an example of the material handled by the SIR. A question was 
raised during the Shuttle Systems Preliminary Design Review (March 1975) 
concerning the lack of data to assure that the proper hardware and 
proper facilities are available to conduct development and verification 
of the ascent flight control system. Rockwell was directed to prepare 
a presentation to SIR with recommendations on meeting the required depth 
of documentation in the Master Verificati? . Plan, Volume II - "Combined 
Elements Verification - Ascent Flight Control." 

Another example of integrated technical management is shown in 
the KSC/MSFC "Memorandum of Understanding For Shuttle External Tank 
and Solid Rocket Booster Support E|uipment," This document is in- 
cluded in Section 7.4 of this volume. 

2 . 1 . 3 , 2 System Contractor 
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System Integration and Shuttle Orbiter efforts are both conducted 
under the same NASA contract number. However, separate cost, budget, 
schedules, and work authorizations are used. Both the Shuttle Orbiter 
and Shuttle System Integration Program Managers (they are Rockwell 
International Space Division Vice-Presidents) report to the Space 
Division President; thus both have equal stature and authority. The 
System Contractor's role, as described to the Panel, is quite broad. 

It is spread over four increments of time: 

(a) Initial increment covers the period during which basic 
requirements must be adequately defined and the design approach mature 
enough to proceed with detailed design, i.e., through completion of the 
Shuttle System Preliminary Design Review. 

(b) Record period proceeds from the end of the above in- 
crement through the Critical Design Review and the completion of the 
design, development, test and engineering effort. This increment 
extends through the first year or so of flight to assure that the 
Shuttle system is safe, reliable, and capable of meeting the oper- 
ational missions. 

(c) Third increment includes production and upgrade/retrofit 
of vehicles for operational use. 

(d) Fourth increment is the operational phase. 

Rockwell International has the equivalent of approximately 420 

persons on their system integration effort. There are some 8 dedicated 
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full-time staff people in the Shuttle Integration Office and 35 per- 
sons located on the staff of the Vice-President for Engineering 
(functional support) dedicated to the integration effort. The re- 
maining personnel are putting effort into integration at' required 
along with their basic work on the Shuttle Orbiter contract. On the 
whole, then, personnel are essentially borrowed from functional 
organizations as required. Rockwell supports JSC, Level II, oper- 
ations in many areas as shown by task assignments in Table III. 

Some of the more significant areas being worked on include 
integrated vehicle analyses such as: 


(a) 

Induced environment definition 


(b) 

Ascent performance optimization 


(c) 

POGO test and analysis 


(d) 

Element separation requirements 


(e) 

Ice-frost prevention 


(f) 

EMC/Lightning protection analysis 

and requirements 

(g) 

Sneak circuit analysis 


(h) 

They also work on the integrated 

schematics which pro- 


vide end-to-end visibility of the functional relationships of all 
components in a system, and as such provide evidence of integration 
of all subsystems, e.g. electrical, electronic, fluid, mechanical, 
etc . 

An area of particular interest to the Panel was the system safety 
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activities conducted by the System Contractor. These include safety 
requirements, program/project reviews, system-level trades, system- 
level hazard analyses, and test /operations safety. One of the many 
examples of their work provided to the Panel was the development of 
a fire/toxicity protection plan and its application across the 
Shuttle program. The single source document for the Orbiter is 
SD 74-SH-0223. It was prepared for the designer to use as the medium 
for achievement of fire/toxicity safety. This document was forwarded 
to the other element contractors as an example of inputs requested 
for development of total Shuttle requirements. 

Based on the material presented and the discussions conducted 
during the period of examination, it appears to the Panel that the 
Rockwell International Space Division has more of a support role to 
JSC than an independent system integration role. Rockwell International 
is satisfied with this role. This is not unlike me experience of the 
Integration Contractor on the Sky lab program some years back. On the 
whole this resulted in an operational mode where the contractor had the 
opportunity to effectively highlight integration problems but not the 
responsibility of controlling the activities of other contractors. 

There has been an obvious effort to separate the Integration and Orbiter 
efforts at Rockwell International and yet retain the valuable abilities 
being applied to the Orbiter for use on the integration effort. Ad- 
vantages are as obvious as the drawbacks e.g., assurance of a knowledge- 
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able but Independent check and balance. There appears to be no real 
problem*) in making this arrangement work to the advantage of the total 
program, but sustained attention should be paid to making sure that 
it does so. 

2.1.4 Special Management Items 

In any program of this size there are bound to be exceptions to 
the rule in management techniques because of exceptional conditions 
of one kind or another. The Solid Rocket Booster project differs from 
the other Shuttle elements in that MSFC itself is the prime contractor 
rather than an industrial contractor. Marshall has contracted for the 
Solid Rocket Motor (SRM) with the Thiokol Corporation (Wasatch Division) 
while maintaining its in-house responsibilities for the design of the 
total SRB and the assembly of the total SRB. The major question asked 
by the Panel with regard to the technical management of the Solid Rocket 
Booster was "Where would the check and balance function come from that 
normally exists between NASA Centers and their prime contractors?" 

The SRB Project Manager is responsible to the MSFC Shuttle Projects 
Manager and is subject to the Level II integration controls exerted by 
JSC as the overall Shuttle manager. Program requirement documents and 
reporting systems are placed upon the SRB organization just as they 
are on any prime contractor except that NASA does not have the inter- 
mediate step of contracting documentation. On the whole there appears 
to be at least as great a control and checks and balances on the SRB 
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effort conducted by Marshall as on any other Shuttle element. This 
is supported by the existence of a special SRB Review Office within 
the JSC Program Office and the strict adherence to configuration 
management systems by the MSFC personnel. 

The NASA Shuttle Organization conducted a Program Requirements 
Review during the latter part of 1974 designed to realign the Shuttle 
program with the available budgets and desired scheduling of activ- 
ities to meet the needs of the design, development, test and evalu- 
ation program. The events in this activity included: 

(a) Definition of possible candidates to be delayed, 
modified, consolidated or deleted. Candidate items involved pro- 
duction, spares, ground support equipment, facilities, test program, 
operational program, technical management details, training and 
simulation work. 

(b) Thorough review of all the possibilities and their 
impacts and value (cost effectiveness). Those deemed most worth- 
while were presented to NASA Management and they decided whether 

to accept, reject, or hold these possibilities open for later review. 

Twenty-eight items were selected and are being implemented. The 
Panel's interest centered on any safety impacts caused by these pro- 
gram changes. Typical of the Panel's concern were in (l) deletion 
of the runway barrier at KSC, (2) the large number of adjustments 
made to the test program (about 397. of the total) particularly those 
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d ‘ aUn * WUh Vlbr “ tl0 " “ d «■«.«. and (3) reduction 

in ground support shipment particularly „ ^ 

*— — — - — - «* ... 

ceived will continue to receive a .afety review to a.certaln any 

adverse Impacts and to bring them to the attention ol the program 

management. Ihe Panel intend, to continue to examine this area to 

assure compliance with NASA Shuttle Management's Intent. 

Ihe Orblter/System Integration contractor's organisation In- 

eludes a staff member covering the Shuttle/USAF B-l Interface. „e 

reports directly to the President of Rockwell's Space Division, mis 

g is useful to both the Shuttle and B-l programs because of the 

transfer of both technological and .nagenmnt Know-how. As an example. 

rhe basic landing gear system design for the Orblter takes advantage of 

that developed for the B-l. a. Shuttle aft thrust structure Is 

made of titanium/boron epoxy reinforcement and the payload doors use 

graphite epoxy honeycomb. These are extensions of the B-l develop, 
ments . 

2 * 2 Organization 

^ previous Panel Annual Report described the organization and 
general management system which has not changed to any great degree 
since then. Significant changes have been noted in Section 2 1 2 
■'Space Shuttle Main Engln , Controller." Personnel chang.s were.de at 

th “ „ 2.1,4 "special .nagement 
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Items" during the DDT6.E phase of the Shuttle program, the Marshall 
Space Flight Center has been assigned the responsibility for the 
integration management of the SRH. It is planned to contract-out 
for the &RB assembly contractor in Fiscal Year 1977. This assembly 
contractor will then have the prime contractor's role and responsi- 
bilities for the total assembly of the SRB. It is expected that 
this contractor will be located as near as practical to the launch 
site operational base. 

The contractor team is being augmented as required to meet the 
maturing design and fabrication posture of the Shuttle elements. The 
principal contractors and subcontractors are listed in Section 7. 5 
of this volume. 

The Panel visited NASA Centers and a number of contractors dur- 
ing the period since the last Panel report and for the first time 
examined the KSC role in the Shuttle program. Because the KSC role 
for Shuttle differs from that on Apollo, Skylab, ASTP and unmanned 
space systems, it is discussed here. On previous programs KSC re- 
ceived, assembled, checked out and launched the vehicles by providing 
basic facilities and support equipment such as the Vehicle Assembly 
Building, launch control center, launch pads, checkout areas, and 
launch support ground equipment such as the propellant loading systems, 
gas systems and environmental control systems, fhe KSC role in Shuttle 
is more complex. 
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KSC had responsibilities for receiving Inspection and control, 
assembly, checkout, and launch on Shuttle as on previous programs. 
However, in addition they will have .responsibility for recovery and 
retrieval operations for the Orbiter and the Solid Rocket Boosters. 
This is completely new. 

Ground operations similar to previous programs include the sus- 
taining engineering effort, logistics and maintainabilit v . However, 
the "turnaround" operations to prepare the Orbiters for flight is 
again completely new. 

Basic facilities built for prior manned and unmanned programs 
will be used with appropriate modification. In addition, the follow- 
ing new facilities and associated ground support equipment will be 
required: runway and taxi areas, Orbiter Processing Facility, a 

highly automated launch processing system to preclude errors and 
speed up the turnaround time, and payload preparation areas. 

KSC will also provide support to the NASA Flight Research Center 
and later on to the Air Force's Western Test Range operation. 

As presented to the Panel at the time of its inspection trip to 
KSC, the KSC Shuttle organization has been fully defined to meet known 
program requirements and the management control systems have been 
developed and are being implemented. KSC manages Its Shuttle work 
force through manpower work packages which identify discreet work 
activities in terms of product and required manpower. These serve as 


contracts between operating elements, project managers and tlu* Center 
mnnngcmcn ( , 

'n»e many o rgani tuitions Involved in the design, development, 
fabrication, and testing of the Shuttle elements and the combined 
system appear to be in place ami manned in a manner conmeiisurate 
with the cost, schedule and performance requirements and expectations. 
Those changes in organisation necessitated by program maturity and 
directed changes will be examined as required to assure that there 
is no detrimental impact on ground and flight safety. 

2 . 3 Review Syste m 

The Shuttle program review system is a direct descendant of those 
systems used on Apollo, Sky lab .ad ASTP programs. To hold down costs 
there is an increasing use of the teleconference method of conduct- 
ing meetings and reviews. 

In reality the Shuttle program review is a continuous process 
occurring on a daily, weekly and monthly basis at all levels of the 
program from the drafting boards to the program management. Period- 
ically a major management control function is inserted into the system 
in the form of a tietailed lonuali.:ed review. These provide a means 
of determining program progress, problems, problem resolution, and 
approving the cut rent program posture as a sound basis for continuing 
to the next program milestone. 

Lite review system ran be examined f rom the point of view of the 
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Cotal NASA Shuttle Program down through each succeeding level of 
management and/or hardware. Within the overall review system there 
are so many different vehicles used to conduct reviews that it is 
possible here to examine only those which the Panel has had the most 
direct dealings: Systems Requirements Review, Preliminary Design 

Reviews, and special reviews.. The many other on-going reviews include 
the Element Quarterly Technical Reviews, Systems Integration Review 
(Panel- SIR) , weekly and biweekly configuration control boards at each 
level of the program (some of these are referred to as the CCB, PRCB, 
etc.), and Orbiter Management Review (OMR). These illustrate the de- 
tailed management oriented review system. 

As noted above the Panel's major interest was associated with 
those program activities that assure that requirements are properly 
implemented and that the hardware/software is certified as having 
been designed and built to the correct and safest possible configuration. 

Background on these reviews follows: 

(a) Purpose of the Program Requirements Review (PRR) was 
to review and define in detail the management techniques, procedures, 
agreements, etc. to bn utilized by all the Shuttle program participants 
and the program technical requirements. This review was completed 

in November 1972. 

(b) The System Requirements Review (SRR) updated the pro- 
gram and system requirements to be utilized by the contractors. Such 


requirements were documented as the NASA Level II busellne and placed 
under configuration change control. Prior to the SRR the Interface 
Control Documentation (ICD) responsibilities were defined as were 
the schedules for ICD completion to support the program. This review 
was completed in August 1973, 

(c) Preliminary Design Reviews (PDR) covered individual 


Shuttle program elements ns well as the overall system. These are 
technical reviews of the basic design approach to assure compatibility 
with the technical requirements and the producibility of the design 
approach, fhe PDR's result in the appropriate authorization to the 
contractor and in-house organizations to proceed with further design 
in accordance with the reviewed design approach, interlace require- 
ments, eoranonality items, etc., and approval or update of the Level III 
baseline documentation. The depth oi these reviews can be decerned 
trom the "Space Shuttle Systems Preliminary Design Review Plan" in- 
eluded in Sect lot 7.(> ol this report. These reviews were completed 
as to Hows: 


o 

Space Shut t lo 

Approach and 

Landing Test 

Nov. 

1974 

o 

Space Shuttle 

Syst cm 


Mar. 

1975 

o 

Orbiter No. 1 

(also called 

101) 

Feb. 

19/4 

o 

Orbit er No. 

(also called 

10.’) 

Feb. 

197 S 

o 

Space Shut 1 Lo 

Main Kngine 


Sept . 

1972 

o 

External Tank 



Sept . 

1974 


o Solid Rocket Booster 


Nov. 1974 


O SOiia ru-ii-iw . — 

. Launch Processing System <*»" ^ 

gseeral aspects of Che Preliminary Design Review. - 

^ ufo real- time management control 
. i-he PDR as a real-life, real liw: 

because they show .he ru* . . 

device as a pace of che "building block" approach - * 

an operational system within budget and schedule. 

, 4 1 #• rsr\ a scries of prior 
SSM , ate.) Preliminary Design Review was bu 

reviews which generally included Proper pager's review., weekly meet- 
in*, and program/project periodic reviews used for visibility an co 
crol of the project. The "building block" approach resulted In the 

Shuttle Systems POR being built on the individual Element P» s 

■ ,d Review Item Disposition (RID; 

All these formal reviews utilise the Review 

activity to point UP discrepancies, they are indicative of the 

scope of the PD, . a. well as the latitude provided to the "working troops 
CO have their input know., and discussed at management levels, 
elaborated on in Section 7.b wherein the review operation is descri e 
^ rid describe, significant discrepancies and inconsistencies as we 
as distinct problem areas determined by anyone on the project/program. 

PI* process usually consists of 10 days or two weeks of full scale 
team reviews of appropriate data and discussion, during which *1* are 
written. The RIDS are then provided to a screening group, follows 
by „ pre-board. ending up at the formal board. Orbiter 102 PER re- 
suited in 978 RIOS and the Systems POR Poured 1,204 RIB,. »«• « 
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the large number only the most significant ones could be presented to 
the formal board. However, the Individual Team Leaders for each of 
the approximately twelve teams of the PDR report to the tormal Board 
on the team activity and major areas of concern. 

There are always some areas which cannot be fully covered during 
the PDR due to a lack of information. These areas require and receive 
the necessary emphasis to achieve a sufficient degree of technical 
and documentary depth so that they may be reviewed within a reasonable 
length of time after the PDR. 

The Orbiter Thermal Protection Subsystem, Thermal Control Subsystem, 
Environmental Control and Life Support Subsystem and Range Safety Avionics 
are some subsystems which will be so handled in the August /September 1975 
time-frame. In the same vein, lack of definition of the Orbital Flight 
Test Program prevented evaluation of the system design against the mission 
requirements so that it too will be covered at a later date. 

Material covered and that which has yet to be examined as a part 
of the PDR process again shows the need to look at the Shuttle review 
system as a continuum which supports the program and project managers' 
needs for design/hardware assurance. 

At a later date each of the elements and the system will be sub- 
jected to a Critical Design Review (CDR) to determine the compliance 
of the completed design with the technical requirements of the NASA 
baseline. The CDR should result in authorization to the contractors 


27 


to proceed with he release o£ detail design to manufacturing, the 
approval of test procedures, and the appropriate revision or update 
of the Level III baseline documentation. The Critical Design Reviews 
begin in the early Spring of 1976. 
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3.0 SHUTTLK PROP HAM ELEMENTS 


3.1 Orbiter Project 

Because of the large number of Shuttle elements and componentS| 
Panel efforts have been concentrated on those areas which most impact 
crew safety and management control of the program elements. The in- 
tent in this report is to focus on the subsystems critical to crew 
safety and to provide data for an understanding of risk assessments. 

A special section is given over to the Orbiter Thermal Protection 
System because the Panel feels it is one of the most significant 
systems which, if njt properly and adequately designed, fabricated 
and maintained, would pose a real crew hazard as well as a Shuttle 


system operational problem. 

However, there are differences between the first two Orbiters 
which should be identified to understand what follows. The first 
Orbiter, Number 101, will initially be configured as a test vehicle 
for the Approach and Landing Test (ALT) Program. It will then be re- 
worked to the operational configuration. The second Orbiter, Number 102, 
will be built in the orbital flight configuration. Thus there are some 
items unique to the 101 and there are other items which appear on 102 for 
the lirst time. Many ot these differences result from the needs for 
flight test instrumentation at low speeds and low altitudes on 101 
versus high speeds and high orbital altitudes on 102. There are also 
dii ferences because ot the diiieivnt natural and induced environmental 
eilects, lor example, on the 101 vehicle there is no Therttv.l Protection 
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System (TPS), little if any internal insulation, and no main pro- 
pulsion system (SSME's). There is an instrumentation boom at the nose 

and ejection seats. 

3.1.1 Subsystems Critical to Crew Safety 

For the purposes of this report the Orbiter system is divided 

into the following subsystems: 

(a) Structures - this includes the fuselage, wings, 
empennage, crew module, purge, vent, drain, payload doors, thermal 
protection system (TPS), and the internal insulation. 

(b) Propulsion - Includes the reaction control system, 
orbital maneuvering system, auxiliary propulsion system and the inter- 
face between the Orbiter and the Space Shuttle Main Engines. 

(c) Avionics - includes guidance, navigation, flight con- 
trol, coranunications and tracking, display and control instrumentation, 
data processing and software, electrical power distribution and control 

(d) Crew Station - includes ail those items, such as fuel 
cells, batteries, and rotating equipment used to store and generate 
electrical power. This does not include those items used for distri- 
bution and control of the generated power. 

(e) Environmental Control and Life Support - these include 
the atmospheric revitalization subsystem, active thermal control, 
cryogenics, airlock support and waste management. 

(i) Mechanical - includes landing and deceleration gear, 
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separation, actuation devices, payload retention and deployment, hy- 
draulics, and pyrotechnics. 

All of these systems and their components may be construed as 
affecting crew safety. 

The Panel chose to focus first on (1) systems extending the 
technical and fabrication state-of-the-art in the literal sense or 
in its application, (2) systems which prior program "lessons" have 
indicated as areas of concern, (3) areas which the Panel members con- 
sidered most vulnerable to "human error' in defining requirements, 
designing and fabricating, and (4) areas which cannot be adequately 
tested or validated on the ground. 

Using the above criteria, the following subsystems received par- 
ticular attention from the Panel: 

3. 1.1.1 Doors and Vents 

3. 1.1. 2 Thermal Protection System 

3. 1.1. 3 Propulsion 

3. 1.1.4 Avionics 

3. 1.1. 5 Electrical Power System 

These are discussed in terms of systems design and current develop- 
ment status. 

Additional subsystems of particular significance for crew safety 
inc lude : 

3. 1.1.6 Crew Compartment 
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3* 1. 1. 7 Hydraulics 

3. 1.1. 8 Separation Mechanisms 

3.1. 1.9 Structures 

Here the conments are more limited for the reasons indicated in each 
section. 

Orbiter weight control has been a major management objective. 
Currently, the estimated weight is about 2000 pounds below the tar- 
get of 132K. Reviews continue to find ways to take weight out of 
existing designs or to find new ways to keep the weight down. Since 
weight control is an important driver, the Panel in its review of 
these subsystems has been sensitive to any impact on safety. 

3. 1.1.1 Doors and Vents 

Doors and vents on the Orbiter vehicle must operate reliably to 
maintain the vehicle's integrity for flight during ascent and reentry 
and to avoid risk to the crew. 

Because of their significance tor crew safety, the following 
doors were included in the Panel's reviews: 

(a) MPS/T-0 Umbilical Attachment Door. Tills door was re- 
cently deleted as a result of the latest aerotherodynamic analyses, 
figure 3 and •* depict the "before" and "after" configuration. 

(b) Reaction Control System (RCS) Forward Thruster Doors. 
These have also been deleted as a result of recent studies. Figure r > 


depicts this change. 


Startracker Door. 


(c) 

(d) ET/Orbiter Closeout Doors. There are two - left and 
right side. 

(e) Air Data System Probe Doors. There are two - left 
and right hand. 

(f) Landing Gear Doors. There are three sets of fairing 
doors - one for the nose wheel and one each for the left and right 
main wheel system. 

(g) Personnel Hatches. There are three. 

(h) Rendezvous Sensor. Currently no information is avail- 
able on this item. 

(i) Payload Bay Doors. There are two 60- foot long doors. 

(j) Payload Pre flight Umbilical Door. 

(k) Vent Doors. These are discussed under the vent system. 

In addition there are doors on the Orbier 101 for use during the 
Approach and Landing Tests on the first vertical flight vehicle 102 
that are not found on the later operational vehicles. 

System Design 

During ascent, door position is a function of required operation. 

For example, the startracker door is closed during ascent while the 
External Tank/Orbiter closeout doors are open until the ET is jettisoned. 
Regardless ol the particular function of individual Orbiter doors, they 
all have to be closed and secured prior to entry. 
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The Pan. 1 reviewed the basis for confidence in the mechanical 
design* The doors themselves are considered as structural items, and 
thus are to be designed to preclude failure by use of adequate design 
safety factors. Recent aerothermodynamic analyses have led to a re- 
assessment of Orbiter doors resulting in the deletion of the Launch 
Umbilical Door and RCS Porwurd Thruster Doors. The remaining Star- 
tracker Door and some vent doors are actuated and latched by electric 
motors driving linkages through gear boxes and mechanical sequencers. 
The ET/Orbiter closeout doors and Air Data Probe Doors are actuated 
and latched by power drive units consisting of two electric motors 
driving linkages through a gear box. 

There are personnel hatches at three locations in the Orbiter 
Orbital flight configuration: (1) crew module ingeess/egress hatch, 

(2) airlock hatch, and (3) airlock/payload bay hatch. The crew module 
ingresa/egress hatch is a circular hatch with double walls. The hatch 
outer surface is covered with TPS and seals at the Orbiter outer mold 
line. The hatch inner surface provides a redundant pressure seal to 
the crew module pressure vessel. The hatch pressure seals may be 
checked for leakage by pressurising the volume between the seals. 

This leak check capability exists during launch preparations or in- 
flight, utilizing OSE or flight equipment. Mounted in the center of the 
ingress/egress hatch is a 10-inch diameter window used for erew obser- 
vations of external conditions and tor the performance of experiments. 



Control of the hatch la manual, utilizing a rotary actuator which may 
be driven from either aide of the hatch and Apollo CM-type hatch 
latches. The airlock hatch la a circular hatch which seals at the 
airlock entry tunnel separating the crew module from the interior 
of the airlock. The hatch is closed and latched for Orbiter launch, 
opened shortly after orbital injection to allow access to the air- 
lock interior, and also is cycled during extra-vehicular activity. 

The hatch pressure seals also may be checked for leakage by pressur- 
izing the volume between the seals. This leak check capability and 
hatch control is the same as for the Ingress/egress hatch. The air- 
lock/payload bay hatch is also a circular hatch which seals at the air- 
lock exit tunnel. Hatch pressure seal check and hatch control again 
is similar to the ingress/egress hatch configuration. There are two 
payload bay doors with an actuation system for each 60- foot half door. 

The Payload Bay door actuation mechanism has not been finalized as 
yet but the following subsystem description can be provided at thi3 time. 
The output motion for door movement is taken off the second ring gear 
of compound planetary gear boxes. There are six gear boxes along 
each power path and these are connected by torque tubes to each other 
and to a main reduction gear box. The main gear is driven by the out- 
put of a double differential connecting three electric motors. This 
arrangement allows system operation for any two motor failures, any one 
motor failure combined with one electric system failure, or any two 
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electrical system failures. A mechanical disconnect of the motor 
drive unit is provided and the door actuator Rear boxes are de- 
signed so they will back drive. Tills will allow the CSE to open or 
close the doors. 

The Purge, Vent and Drain Subsystem is composed of five elements: 
(1) structural compartment vent, (2) structural compartment ground 
purge, (3) structural compartment drain, (4) window cavity condition- 
ing, and (5) hazardous gas detection. The individual systems are not 
discussed here since the major focus is on the safety Impacts associated 
with these systems. The vent ports insure no violation of the delta 
pressure limitations of the primary structure and therefore are of 
primary significance for crew safety. It is the proper mechanical 
operation of these doors that is critical, not the structural integrity 
of the doors themselves. 

There are some eighteen of these vent doors along with the asso- 
ciated electro-mechanical and mechanical operational devices to move 
them as required. The other purge, vent and drain units present con- 
siderably less risk to the crew. However, malfunctions could lead 
to mission abort. 

Tlie structural compartment ground purge provisions are composed 
of a USE- supplied flow of air/CNv/Olle, which is distributed through 
an onboard duct network to all required structural compartments. The 
structural compartment drain provisions are composed of piping and 
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il 1 Hconnec Ls \4iidl, acting 1 oget.her with g round support: equipment, 
minimize the accumulation of moist are wit hin the Orbit or structural 
compartments. 'ilie rollon: Jon points arc so located jli.u effective 
draining, is feasible wit h tin* orbl lcr l.n cither the horizont al or 
vortical attitude. The window cavity conditioning provisions allow 
the introduction ol it ground -supplied dry nitrogen purge into the 
inner and outer window cavities during pre flight servicing oi the 
Orbit er. During the .approach and landing 1. lij'ht tests and boost to 
orbit, the gas in the window cavities is vented through lines to 
overboard. While in orbit they are continuously venting the space. 
During the entry phase ambient atmosphere Hows into the cavities. 
Appropriate valves act to limit the delta pressure across the window 
panes in the event oi filter or line clogging. The hazardous gas 
detection provisions utilize a combination ol Might hardware and GSE 
to detect the presence and monitor the concentration oi hazardous 
gases during prelaunch and post- landing operations. 

Current Status 

boor designs, as described to the Panel, are such that the door 
itself and the mechanical linkages and gear Iioms are considered the 
same as primary structure, i.o., they are designed with suillcient 
structural safety margin t o preclude mi lure under any known or 
suspected load condition. 

The door operat ing, median i sms are quit e complex and there are 
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continuing efforts under way to simplify these mechanisms. 

In the main the doors are contiguous with the Orbiter Thermal 
Protection System (TPS) and as such Interact from the aero thermodynamic 
standpoint with the function of the TPS. 

Rigging of the external doors is difficult and must be done in 
the ’’blind" in many cases. As a result it is difficult to prove that 
door latches latch and lock properly and the chance for human error 
is present to a degree that may require more than average detailed oper- 
ational and inspection controls, or verification procedures. The Panel 
will review this area as the program evolves. 

The ET/Orbiter Separation Cluster Plate Doors and Stattracker 
Dour continue to be the subject of studies to determine whether the 
doors and their associated mechanisms could be eliminated, recon- 
figured, simplified, or reduced in size thereby reducing or elimi- 
nating the crew safety risks associated with improper door operation. 

The results of these studies will be the subject of further Panel 
review. 

The External Tank/Orbiter Cluster Plate Doors are now about 
46" x 62" (actually some 2354 sq. in.) rather than the original 72" x 84" 
size. The maximum exterior surface temperature of the door when closed 
during reentry is about 1500° F. It is estimated that without the 
door local temperatures would be 1.5 to 2.5 times as high due to flow 
disturbances. Ihese doors are open during launch and ascent until ET 
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H epa ration and It would appear that an exten.lve teat program tt> a.snro 
propur operation In the po.t-la.rn.-h environment 1. warranted. 

Thu Startrnekcr door alee la dictated by tracker view angles 
and the requirement ior daylight tracking. Tracker-linea of sight 
arc made more difficult by the thickness of the Orbltcr TPS material 
surrounding the window itself. Maximum temperatures near the Star- 
tracker door are expected to be about 825 1 ' P. The door mechanism 
and the alternatives are still under evaluation. 

Venting analyses have been conducted to determine the effect 
on the Orbiter vehicle of internal compartment pressures due to 
opening the vent doors at different altitudes during reentry. At 
the time the active vent doors are closed, prior to reentry, the 
pleasure in all of the vented compartments is approximately aero. 

The Orbiter enters the atmosphere with the doors closed until the 
"hot" part ol the descent Is completed. The vent doors are then 
opened at about 70,000 - 80,000 feel and remain open until the Orbiter 
is on the ground. If the opening of the doors is delayed to a lower 
altitude, excessive d L , tetent lal pressures could develop across some of 
the compartments. Analysts indicates that t, takes about 15 seconds 
to open the vent doors. On the other hand those vent doors which 
open too soon may produce problems due to .he impingement of hot 
plasma on structural members. The active vent system selection was 
extensively reviewed and approved by a number ol tout motor and NASA 
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organizational elements, including the Shuttle System Program Manager. 
The Orbiter vent system appears to have been sized and analyzed for 
nominal ascent and reentry trajectories, and no detailed analysis 
has been made to assure adequate operation of this system during abort 
or vehicle malfunction conditions. Venting analyses for these con- 
ditions are not currently underway, but should be available some- 
time after July 1976. 

Two failure modes of the vent system that have been under study 
because of significance to crew safety are the failure of the OMS 
pod vent and wing vents to open. JSC venting analysis showed that 
the fuselage can tolerate a single system failure, but the wings and 
OMS pod would fail structurally. The time to troubleshoot such a 
failure is very short (in seconds) and therefore backup procedures 
cannot meet the need. 

The present Orbiter baseline with regard to Orbiter doors and 
their functions/criticality are shown in Table IV . 

3 , 1.1. 2 Orbiter Thermal Protectio n Subsystem 
Systems Designs 

The Thermal Protection Subsystem (TPS) consists ol the equip- 
ment used to insulate against the external aerothermodynamic or in- 
duced heating effects on the Orbitei vehicle. The Thermal Control 
Subsystem (TCS) maintains appropriate Orbiter thermal conditions. 

Thu Panel has examined the TPS in detail and considers it one of the 
most significant subsystems on the vehicle. While not much attention 
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has been given the TCS, it will be examined more closely during Che 
coming year. 

The TPS consists of those materials applied to fixed and move- 
able surfaces to protect the underlying aluminum structure and heat 
sensitive equipment. The TPS has undergone an evolution in design. 

Changes have occurred in tile materials- coatings, and configuration. 

The system will be reviewed in a PDR this sunnier. 

TPS design for operational vehicles (Orbiter 103+, Subs) includes 
five different thermal coverings rather than the current design using 
three types: 

(a) hew temperature reusable insulation 

(b) High temperature reusable insulation 

(c) Reinforced carbon-carbon nose caps 

(d) (New) Nornex "E" fell with coating of white silicone oxide 

(e) (New) bare surfaces with coating Lor emissivity/absorptivity 
Current configurations are shown in figures *' to ^ . 

Studies have been underway to ' ry and simplify and reduce the 
cost: and weight of the Thermal Protection Subsystem, both JSC and 
Rockwell have been heavily involved in these activities. 

The modifications between last summer and the spring of 1975 
are due to a change in trajectory which resulted in lower temperatures, 
lower heating rates and a better tile design, based on a more sophisti- 
cated thermal analysis ot the tile joint er.us. 
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Areas that have received increasing attention are the aero-surface 
thermal seals: elevons, rudder/speed brakes, and body flap. These 
seals must (1) provide thermal protection for the aluminum structure 
to a maximum of 350° F., (2) restrict flow of air and/or plasma from 
the high to low pressure areas, to allow aerodynamic control of the 
vehicle, and (3) have 100-mission life capability in operational vehicles. 

Wing eievon seals must provide sealing between the: 

(a) Eievon to fuselage 

(b) Eievon wing (top and bottom) 

(c) Elevon-to-elevon 

(d) Eievon wing tip 

These are complex seal arrangements and have not yet been fully de- 
tailed and analyzed. 

The vertical tail seal is a conical tube running the length of 
the rudder as shown in Figure l) . The body flap seal concept is 
shown in Figure 10 . 

Among the objectives in developing tile Installation procedures 
are finding wa^s to minimize the number oL tiles and shapes and to 
simplify the maintenance removal or repair of Liles, because of the 
difficulty in maintaining precise airframe substrate surface tolerances, 
as well as tile installation height L' io ranees, Rockwell Space Division 
has developed the "building-block" approach tor installing tile on the 
so-called "acreage" areas comprising about 80 percent of the Orbit er. 
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In this approach standard tiles are used in large areas. Special 
rows of closeout tiles are added to fill in the gaps between adjacent 
areas. 

The remainder of the tiles will have to be shaped and fitted for 
such multiple curvature situations and penetrations through the TPS 
subsystem as: 


(a) The line between the RCC installations and adjacent 
tile installations. 


(b) Windshield 

(c) Forward fuselage hoist point 

(d) Actuator access doors 

(e) Rear access panels near OMS pod 

(f) Structure cavity vents 

(g) RCS thruster package doors and opening 

(h) Nose gear doors and main gear doors 

A part of the installation procedure includes the pre-fit of 
tiles on the vehicle surface with a hand sanding of the le;er tile 


surface to match the inner mold- line of the Orbiter and hand sanding 
ol the upper surface to match the required outer mold line dimensions 
in order to control the "step" that exists between tiles. This is 
shown in figure 11 an indicates the maximum allowable tolerance to 
preclude "fouling" the airstream tlow over the vehicle surface. Thus 
a tile- to- tile step of +0.030" to -0.0 r >0" is allowable in most in- 


stance., and a tile gap of 0.050" nominal la allowed. 

Current Status 

TPS concerns and Issues that have been resolved and those still 
challenging the designer, which have been of specific Interest to the 
Panel during Its reviews of this subsytem, can be summarised as follows: 

(a) Experience working with the reusable surface Insulation 
(RSI) or tiles shows It has low resistance to ground handling damage. 

It has che capacity to sustain damage without catastrophic failure 
during exposure to induced environment. Installation costs and time 
requirements are sensitive to the gap and step criteria, tile con- 

figuration and installation techniques. 

(b) the low temperature tiles appear now to provide more pro- 
tection than needed, based both on the change in trajectory and the 
results from recent tests and analyses, this over-protection is also 
a result of the minimum tile thickness of 0.2 inches, this thickness 
is derived irom the structural properties of the tile and its tendency 
to crack when any thinner than that. As a result, the use of Nome* "E" 
folt with a white oxide coating has been tested and found practical as 
a replacement for some 3,275 ft. 2 of surface which achieves a maximum 
temperature at the outer mold-line of 700" F. or less. Information 

to date shows the Nomex felt to be acceptable for 100 mission use for 
temperatures up to 600* K. and very possible to 700° F. There are some 
>,000 plus it. 2 Of the area meeting the bOO degree requirement. There 
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are even areas on the top of the Orbiter that could be Clown without 
any TPS at all. Arc jet testing conducted in early fall and winter 

indicated that the Nomex and coating remain elastic and waterproof 

o o 

for 100 mission cycles at 600 F. and for at least 50 cycles at 700 

F. A further investigation was initiated 25 January 1975 to resolve 
some of the remaining challenges. These include the extent of degra- 
dation of the coating with exposure to ultraviolet radiation, partic- 
ulary degradation of the thermal radiative properties of absorbtivity 
and eiranissivity and perhaps elasticity. Although there are no par- 
ticular structural or /ibroacoustie concerns, there is the current un- 
known of what contamination does to the coating. The program also 
needs more information on the capability of Nomex to handle temperature 
dispersions, particularly those over the designed- for values. Rockwell 
has demonstrated the manufacturing and installation ability of the 
Nomex felt and indicates a weight savings on the order of 500 pounds 
if used on the 2000 to 3000 square feet of surface area currently cited. 

The Panel has also been monitoring the studies to assess the 
hazards from: (1) ET insulation ablation products deposition on Orbiter 
glass surfaces and TPS, anu (2) ice and l.rost breaking away trom the 
ET and striking the Orbiter TPS. Tests and analyses have been con- 
ducted to assessthe F.T/Or biter interaction. As a result it was con- 
firmed that the abalation products will not flow over the windshields 
or the top observation windows and does not materially affect the TPS 
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absorptivity and emissivity or its ability to adequately protect the 
aluminum structure. The possibility of TPS damage resulting from 
ice and/or frost forming on the ET and then breaking away during 
and prior to the ascent portion of the mission is still an open 
item receiving attention. When this is completed, if in fact a 
problem exists, protection will have to be afforded the TPS during 
the boost phase. Tests to date are not conclusive. Model tests indi- 
cate that ice will not form but frost will. 

Natural environment factors such as rain, hail, lighting, and bird 
impact have been studied relative to their effect on the TP 5. To 
assess rain erosion, precipitation models for KSC and Vandenberg AFB 
have been developed based on NASA and Air Force data. These models 


as augmented by tests and analyses indicate the following probabilities 


during ascent and descent at both 


of encountering critical 
launch/ landing sites; 
Flight 
KSC Ascent 
KSC Descent 
VAFB Ascent 

If 

ascent, 
ability 


rains 

Per One Flight 
0.317. 
0.0137. 
0.047. 
0.00117. 
'loped for 


Per 100 Flights 
26.77. 

1.267. 

3.97. 

0.117. 

Edwards AFB. During 


erosion problem. Cap- 
reentry to avoid rain is quite limited. 


VAFB Descent 

required, such data may be de 
launch constraints can reduce the rain 
lor maneuvering during 
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As a result erosion has to be accepted and the TPS refurbished as 
required during the maintenance and turnaround period. Such erosion 
Is not considered a crew hazard as such. 

As for Ice Impact and hail tests have shown that the tile does not 
exhibit significant resistance to ice impact damage. Atmospheric ice 
is encountered at altitudes below about 50,000 feet. Hail may occur 
only within or below thunderstorm cells and is observed very infre- 
quently at the surface at both KSC and Vandenberg AFB, Higher fre- 
quencies occur at altitude. Studies indicate that the probability of 
encountering hail during ascent is about 0.00757, and during descent 
about 0.0157. on an annual basis. Since hail is a thunderstorm phenomena, 
the probability of hail encountering hail during launch may be reduced 
to essentially zero by constraining launches. During horizontal flight 
the ability to perform flight maneuvers are neglible and flight through 
area thunderstorms cannot be avoided. Hail would not be catastrophic 
but would certainly require significant rei urbishment after landing. 

Bird impact data from both civilian and military sources have 
been analyzed with respect to the Orbiter flight trajectories and 
expected frontal area subjected to bird strikes. Specific attention 
was given to the windows as the most significant area of concern and 
the TPS ns secondary. Because the probability ol a bird strike is 
extremely low, the program has deemed it practical to accept, such low 
probability risk. 
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TPS is obviously subject to "people" or handling damage. There- 
fore those personnel coming in contact with the Orbiter must be 
trained and constantly be reminded of the fragile nature of the 
tiles. Where possible, the ground support equipment should be de- 
signed and used in a manner which minimizes any inadvertant damage 
to the TPS. 

Lightning effects on the TPS are continuing to be studied to 
assess the adverse effects, determine how they can be eliminated or 
minimized and to define necessary constraints. The current baseline 
has not designed the TPS for a lightning strike. Without any avoid- 
ance measures the probability of a lightning strike would be about 
0.0087. for all altitudes up to 50,000 feet for launches from KSC. 

The probability of a strike at Vandenberg AFB would be consider- 
ably less, based on lightning occurrence there. Selective time of 
launch can reduce the probability of a strike by at least an order of 
magnitude . 

Solid Rocket Booster separation motors in their original con- 
figuration would have impacted the TPS when fired. As a result of 
these analyses the forward SRB separation motors were relocated 120 
inches forward. Their thrust was increased from eight units of 12,000 
pound thrust to Lour units of 20,000 pound thrust. The firing time 
was also reduced from two seconds to a period of not more than 0.75 
second . 


48 


Tile Installation Is sensitive to structural buckling caused by 
thermal stresses along the forward fuselage, ,„ld- fuselage and a few 
panels on the upper and lower surfaces of the wings. Orbltnr specifi- 
cation requirements are chat there be no buckling below 115'/. of limit 
load on ascent and 100% of limit load on descent. As an example. In 
the mld-fusclagc and wing areas the Initial design assumed etrlngers 
provided adequate stiffness end spacing to preclude buckle until limit 
load was reached. Subsequent analysis and testing showed that buckling 
occurred considerably below the design load. The cause was the trans- 
verse skin compression stresses Induced by combined thermal and mechan- 
ical loads. Such buckling disturbs, 11 not breaks, the TPS subsystem. 
The current approach to res living this problem Is to conduct tests to 
structural ultimate strength and determine ability of the TPS sub- 
system to accommodate the hurtling without failure. Then the program 
will be in a position to define stiffening modifications and retest of 


TPS installations. 

Another area of concern was the effect of the salt sir environ- 
ment on the chemical stability of the tile coatings at the elevated 
temperatures anticipated In ascent and reentry. A, a result of this 
concern, a test program was conducted at JSC. In the 1.5 megawatt are- 
jet tunnel facility to evaluate- the- elects of the- salt contamination 
on the reuse capability ol the high temperature thermal protection 
material. Test results Indicate that salt accumulations representative 
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of up to ten yeara oi launch pad wl no ^ 

var, e on the reuse capability of thu , mi m , d (u co>tinR 

approximately 100 missions. 

The hi 8 h temperature (greater than 2300° v ^ , 

11 ^ JUU 1 •) thermal protection 

■"'"I” 1 18 ^ ° £ t0l " £0r “‘ 1 material. This Mortal 

consists oi pyrollzed osthon fiber. tn . pyrollzed carbo „ ^ ^ 

o suitor carbide coating. Extensive development testing s„d analyse, 
.re still in process to dateline actus! petioles characteristics 
anf to confirm the ECC configuration as designed, as well as alter- 
nate designs which n»y he used a. the final analyses converge on the 
anal design. A design review for this area is scheduled for the 
summer of 1975. Two major prohlems with the RCC material are (1) sub- 
surface oxidation, and , 2 > inter-laminar failure occurring within the 
Pyrolyzed matrix itself. S ub-,„rface oxidation result, in ™.s l 08s 
Which is a function of mission environs pressure and temperature 
for example, tests are presently being conducted to determine how 
best to meet the particularly severe environment where the shoch wave 

0£t ^ ““ 01 tHe 0rblt “ r *«““«• - wings. The inter- laminar 
tailure problem is one of 

processing and now appears to be 

resolved . 

The TPS test program includes (1) material v. 

' ) material characterization, (2) 

design development testing and mi t 

0) dt ' si « 11 verification. The results 

th ° tCSl pr0sr "" 1 *«* «.» be summarized as follows: 
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(a) ihuisablo surface insulation (tiles) have |>ren i^ihI 
lor "art fabricated" proper!: i es and I hese test resulls are being 
evaluated lor del enniniug any Inline leal requl renmii a for material 
characterlzat: Inn. 

(l>) Reinloreed carbon-carbon leal program is approximately 
complete with scheduled comp let ion jn I'ehrnary 1 ')’/(» . 

(c) Seals used on moving stir laces are t» (he very early 
slaves ol' maierial character! /.at ion testing. 

(d) Design development testing covers those tests con- 

due Led Lo conlirm analytical methods, support ol design configuration 
selections, and establish veri t : Lea Lion Lest methods, for example, 
a 0. 36-scale model wind tunnel test is in process at Ames Research 
(.enter to measure el lee is ol TPS on low-speed aerodynamics. Some 120 
ti'sls are to be performed on tills model in the low-speed 40 x 80 Loot 
wind tunnel. Lost rile tests, structural tests, fatigue tests, flutter 
tests and lightning tests have been, and continue to he, conducted. 
Aerodynamic heating in the gaps between the silica TPS tiles is 
receiving attention through tests to assure that these phenomena 
.ire correctly modeled in the analyses used t o detiue tin* configuration 
ol the TPS. 

In summary, the Orbitrr IPS is a dit i iciilt and complex system 
to design aiul uiuler s t and . None the less, the analyses and testing, 
conducted to date indicate that I lie design and operational complex- 


tries are yielding to the planned development effort. The remaining 
concerns or challenges include the following: 

(a) Improved RCC coating to increase material lifetime. 

(b) Decision on use of Nomex felt in lieu of thin tiles. 

(c) Thermal protection of penetrations (aerosurface seals 
and movable doors) 

(d) TPS sensitivity to structural buckling. 

(e) Tile-to-tile high tolerance to preclude "tripping" or 

disturbing the airstream. 

(f) TPS inspection, maintenance, and handling. 

<g) 100 mission reusability. 

3. 1.1. 3 Propulsion Systems 
System Design 

Thi3 section deals with four separate power systems: (1) Aux- 

iliary Power Unit, (2) Forward and Aft, (3) Reaction Control, and (4) 
Oribtal Maneuvering Subsystem. The main propulsion system for the 
Shuttle integrated system is covered under Section 6.6 of this report. 
The portion contained in the Orbiter vehicle, the three main engines, 
is covered in Section 3.2. 

The Auxiliary Power Unit Subsystem consists of three independent 
APU's, each having pressurized fuel storage and distribution, an APU, 
lube oil cooling, and exhaust, vent and drain provisions. Each APU 
provides mechanical shaft power to one main hydraulic pump of the 
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Orbiter Vehicle Hydraulic Power System. At least two APU-hydraulic 
systems must be operational to assure sale return oi the crew and 
vehicle. Operational flight control requirements for the Orbiter 
for the approach and landing phase can be met with any one of the three 
APU systems failed. With two systems failed, the remaining system 
with overspeed cannot meet all operational requirements and may not, 
therefore, be capable of returning the crew and vehicle safely under 
all mission design conditions. 

The forward RCS provides precise attitude control and three-axis 
translation during separation from the External Tank, orbit insertion, 
and orbital phases of the flight. The aft RCS does all of these same 
functions in conjunction with the forward RCS and also provides thrust 
for the reentry phase of the mission. The forward RCS has eleven pri- 
mary and two vernier thrusters mounted under doors and six thrusters 
mounted exposed. The doors remain closed and latched during boost and 
reentry phases and are deployed and locked in place for ET separation, 
orbit insertion and orbital phases. The aft RCS is composed of twelve 
primary thrusters and two vernier thrusters located on either side of 
the aft Orbiter fuselage for a total of 24 primary and 4 vernier units. 

The primary RCS engine specification requires the engine to in- 
corporate a burn-through detector to sense an incipient thrust chamber 
burn-through and to provide an appropriate signal to be used by engine 
shutdown. This is a dii'ficull item to develop and qualify and may also 
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cause operational problems due to false shutdown. It is now con- 
sidered that burn-through is not one of the primary failure modes. 

The contractor was asked to process a Master Change Record (request), 

MCR, to delete the burn-through detector per the 102 PDR (February 1975). 

The Orbital Maneuvering System (OMS) provides the propulsive thrust 
necessary to perform the following maneuvers: (1) final velocity in- 

crement for orbit insertion, (2) orbit circularization, (3) orbit transfer 
(4) rendezvous, and (5) de-orbit. Although one OMS engine could be used 
for these operations, reliability considerations dictate that the loss 
of an OMS engine is cause for abort. 

The OMS has single failure points in the pressurization and pro- 
pellant feed areas and the failure mode would be rupture and excessive 
leakage. Any excessive pod differential pressure could result in 
structure and TPS damage preventing safe reentry. The OMS is fail 
safe otherwise, except for such catastrophic events as engine or pro- 
pellant explosion. 

Current Status 

There are numerous mechanical connections used on the forward 
and aft RCS in lieu of welded connections. This approach permits 
removal ar.d install*’ tion of equipment in minimum time while minimizing 
contamination hazard to the remaining portion of the system. Where 
possible the fittings and seals being used were already qualified in 
the same application in Apollo and Skylab programs. After reconnect 


all mechanical connections will be pressurized to system pressure 
with helium and externally leak-tested to system requirements. 

NASA and contractor have agreed to maintain tight surveillance 
of mechanical connections (fittings) to assure both the number and 
possibility of leakage are minimized. 

Verification of component propellant compatibility of CMS/RCS 
hardware is under review. Based on the demonstrated Apollo CSM 
experience, the current requirement is that components be constructed 
of materials with demonstrated propellant compatibility. However, sub- 
system design features and operational methods, as well as program 
funding limitations precludes compatibility testing at the component level 
of the OMS high pressure helium isolation valve, helium pressure regu- 
lator, low pressure vapor isolation valve, and the tank pressure re- 
lief valve. 

In the RCS the plan is to authorize only those materials in the 
helium system where there is proven compatibility with the propellants. 

The data and analysis will be accomplished during the development and 
qualification programs. Because of the propellant system components 
total exposure to liquids, a qualification compatibility test will be 
conducted at the subcontractor level. 

deletion ol the vihro-acoust ic test of the forward fuselage has 
meant cancellation of the vibration test ol the forward RCS module. 
However, the need for system certification ol the RCS prior to first 
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verticle flight has not been eliminated, so a reassessment of means and 
techniques is underway to provide th< required certification data base. 
Plans are to review aft pod vibro-acoustic tests, system similarity 
and analytic techniques to see if aft pod data can be extrapolated for 
application to the forward RCS module. In addition, alternate forward 
module test plans and schedules are being studied to determine a cost 
effective vibration test for the forward module only. Resolution of 
these alternatives and a recommendation is due around l July 1975. 

3. 1.1. 4 Avionics 
Systems Design 

The avionics subsystems provides commands, guidance and navigation 
and control, communications, computations, displays and controls, instru 
mentation, and electrical power distribution and control for the Orbiter 
external tank and the solid rocket booster. The avionics are configured 
to facilitate checkout, access, and replacement with minimal distur- 
bance to other subsystems. Equipment locations are shown in Figure 12 
Computations or data processing is accomplished through the use of 
five digital computers. Three are dedicated to the guidance and navi- 
gation function. One can be used for either guidance and navigation 
or payload and performance moni tor ing,and one is dedicated to payload 
and performance moniLoring. Software or computer programs are integral 
to this data processing and control system since these five general 
purpose computers are the same mode. It is the resident software that 


determines the computer function. 

Verification of the avionics/software systems as an independent 
and integral part of the Orbiter/Shuttle system is accomplished through 
the following test programs: 

(a) Software Development Laboratory program to verify the 
flight data on flight computers. 

(b) Avionics Development Laboratory program to verify "single 
string" and redundant hardware system operation and the hardware/soft- 
ware compatibility. 

(c) Shuttle Avionics Integration Laboratory (SAIL) program 
to verify redundant hardware system operation for Orbital Flight Test 
as well as the hardware/software compatibility for OFT. 

(d) Simulations to verify flight crew operations of vehicle 
and the guidance and navigation performance accuracy in a manner similar 
to simulations for prior manned spaceflight operations. 

(e) Approach and Landing Test (ALT) program using Orbiter 
iOl will be used to verify the aerodynamic capability of the Orbiter, 
the aerodynamic guidance and navigation performance, aerodynamic 
system integrated operation and the aerodynamic dependent software. 

(f) Orbital Test Flight program to verify the total mission 
vehicle capability with avionics and associated software. 

Orbiter 102 will have the following avionics elements not on 
Orbiter 101 
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(a) Startracker/Light Shield 

(b) Those portions of the flight control system that In- 
volve the Reaction Control System, Orbital Maneuvering System, Thrust 
Vector Control for the SSME's. 

(c) SSME interface unit portion of the system for processing 
engine data. 

(d) Many items of the communications and tracking system, 
e.g., KU band radar, payload interrogator, signal processes, portions 
of the S-band, etc. 

Current Status 

The relationship of avionics to the flight and ground crew safety 
is multifaceted, since every action and reaction during the mission 
is controlled to some extent by the avionics system. The Panel has, 
therefore, had to be selective. We have chosen to review three areas 
most significant to crew safety: (1) Orbiter/SSME-Controller inter- 

face, (2) ALT/OFT flight control modes, and (3) abort operations. 

A review by the Panel was to determine if there are potentially 
critical failures across the Orbiter/SSME interface, and, if so, to 
understand those steps being taken to minimize or eliminate such efects. 
Where hazards are not eliminated we wanted to assure that the assess- 
ment of the risk and the rationale for accepting it had been given 
appropriate management attention. 

Operational and checkout commands and engine flight data are 


supplied via the electrical interface connectors, at the engine- 
supplied electrical interface connect panel. Commands consist of 
engine start, shutdown, thrust level changes, checkout, and sequence 
checks. Engine flight data transmitted to the vehicle consist of 
information necessary for malfunction display, fault isolation, 
maintenance recording, trend analysis, performance monitoring and 
checkout. Three parallel redundant connectors provide a reliable path 
for the Orbiter to engine commands. Further a minimum of two of the thre • 
commands must be received before the engine response will be initiated. 

Two of these connectors are also employed to transmit the engine flight 
data back to the Orbiter. Failure to provide correct command during 
ascent or to transmit engine performance back to the Orbiter do not 
appear to be a direct threat to the crew safety since the engine will 
continue to operate on the last correct command received. 

Flight control utilizes automatic commands determined by the guid- 
ance and navigation subsystem manual commands provided by the crew, 
vehicle motion sensed by the sensors, logic decisions processed by 
the control laws, and those forces produced by actuation of the aero- 
dynamic surfaces TVC's, RCS, etc. to perform stabilization and con- 
trol. The control laws are software. The flight control requirements 
for each mission phase (ascent, on-orbit, reentry, and atmospheric) 
are specified in terms of control mode elements. These mode elements 
or control modes are the building blocks which can be used in combi- 
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nations to provide the actual operational control modes. During 
ascent through the SRB staging the nominal baseline has been de- 
fined as automatic mode. While there is manual redundancy it will 
not be used unless there is a significant benefit. After that 
portion of the ascent period, the flight control inodes can be (1) 
manual direct, (2) manual conmand augmentation, (3) hold, (4) select, 
and (5) automatic. These are defined in Table V . one of the areas 
being worked by the program that will be examined by the Panel is the 
identification of OFT launch failures which require manual guidance 
and control. Another area is the aerodynamic tolerance effects on 
response and stability of the flight control/structures design cap- 
ability. Structural constraints have been reflected back in a manner 
which indicates a need to restrict the angle of attack and side-slip 
variations to a minimum consistent with ability to provide for high 
aerodynamic load relief. Systems studies have indicated that these 
constraints are only marginally reached with nominal system para- 
meters. i light control margins are tight and vehicle dynamics are 
pushing the margins (plus/minus tolerances or limitations on system 
input/output lag, accelerations, roll rates, etc.). The first stage 
ascent is the period of greatest concern from the standpoint of com- 
puter cycle time. There is a possibility that sample frequency re- 
quirements may increase. If so, this would further aggravate the 
computer timing problem. 
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The role of the avionics system In abort operations Is par- 
ticularly significant because of the need for large quantities of in- 
formation concerning the vehicle and its performance as well as the 
need for fast reaction to on-going events. Confidence in the design 
capability of the Orblter vehicle and its avionics subsystem to per- 
form the once-around-orbit , return-to-landing-site or any other abort 
mode is being examined on a continuous basis as the design matures 
and the system capabilities are further designed. The Panel will 
examine this area in more detail as the concepts and design mature. 

A back-up flight control system is being installed in Orbiter 
101 only to provide protection against generic software problems 
or problems with the complex hardware, crew interfaces, and mechani- 
zation. No new hardware is anticipated. This approach should pro- 
vide an additional measure of safety during the early flights of the 
ALT program. 

This concern with overloading the computer capability in the 
Orbiter is real. It has been stated that at this time the word 
requirements are in the range of: ALT 2700-2800 words, OFT on-Orbit 

2000-5000 words and entry 5000-6000 words (on orbit and entry are 
additive). The main drivers on the computer and the flight control 
requirements are speed and memory. 

A number of flight control support tasks are being carried out 
by NASA Centers. Marshall is working on: 
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(a) Ascent flight dynamics and control. 

(b) FCS requirements and constraints. 

(c) Flight dynamics/stability performance. 

(d) Body-mounted sensor complement and locations. 

(e) Digital sampling/ filtering and quantization. 

Langley is working on: 

(a) Entry guidance and control. 

(b) Independent evaluation of flight crew role in con- 
trolling Shuttle. 

(c) Orbiter G&C entry design verification. 

The Flight Research Center is working on: 

(a) Entry aerodynamic flight control, developing an F-8 
digital fly-by-wire program for DPS and flight control redundancy 
management and flight control system design. 

A number of avionics elements have not been placed on contract 
as yet or design lias not evolved sufficiently to review it. The 
Integrated Electronics Assembly is not yet on contract. Many of the 
operational communications and tracking hardware will not be con- 
tracted for until 1976-77 period. This also holds true for display 
and control equipment for 102. Those areas, with safety implications, 
will be reviewed by the Panel at the appropriate time. 

.) . 1 . 1 . 5 Electrical Power Subsystem 
Systems Design 
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The electrical power subsystem generates the electrical power 
and la active throughout the vertical flight test program and oper- 
ational flight and during ground operations when ground support equip- 
ment is not connected. 

This electrical power subsystem Is comprised of the power re- 
actant supply and distribution and three fuel cell power-plants. The 
electrical power subsystem Is shown schematically in Figure 13 . 
During peak and average power loads, all three fuel cells and buses 
are used; during minimum power loads, only two fuel cells are used 
but they are interconnected to the three buses. The third fuel cell 
is shut down but can be reconnected within 15 minutes to support 
higher loads. Excess heat from the fuel cells is transferred to the 
Freon cooling loop through heat exchangers. 

Most of the active elements of the electrical power system have 
been designed to sustain two failures and remain operationally safe, 
in other words fail-operationnlly then fail-safe. The power reactant 
supply and distribution tanks, electrical power subsystem plumbing, 
and passive elements have been designed to provide fail-safe oper- 
ation after a single failure by means of redundant subsystem flow 
paths which are physically separated. A single product water-line 
is provided to the environmental control and life support subsystem 
since fail-safe water requirements are provided with (he environ- 
mental control and life support subsystem. 
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flit?, operational use of fuel cells for manned space flight evolved 
during the fiemfnl, Apollo, and Skylnb programs. The .Space Shuttle 
fuel cells will be serviced between flights and re flown until each 
one has accumulated some 5000 hours of online service. 

Interfaces of the electrical power subsystem with other subsystems, 
such as the avionics for control, and environmental control and life 
support subsystem, have not as yet been examined Lo any degree by the 
Panel. The Panel's major concerns here will deal with (1) crew hazards 
resulting from subsystem failures, e.g., loss of power to critical 
functions, (2) fire hazards resulting from short circuits or other 
lai. lure modes, and (3) system design to prevent or inhibit deleterious 
evenLs from propagating. 

Current Status 


Based on latest available data, it was noted that the current 
power requirements exceed the electrical power subsystem capability, 
i’he present electrical power requirement of 2006 KWH exceeds the 
1609 KWH capability for the Orbiter 102. Mission energy require- 
ments for seven days exceed the baseline cryogenic storage capability, 
i.c. , tank sized for 1530 KWH. Activities underway are normal for 
this type of concern at this stage of vehicle development. The pro- 
gram is scrubbing electrical loads and equipment duty cycles to 
eliminate unnecessary power loadings. Monthly electrical power status 
lorts arc now being issued 'o assure high level contractor and NASA 
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visibility and rnnlimw'd nmlidl, 

Also, based on the pi lor experience of (In* Panel parti culnr 
interest i s focused on the electrical. power subsystem f l uid tubing 
connections and the Quid 1 1 no insulation. These two areas urn 
shown schematically wi th brief descri .pi i .vr material. in Figures 
and lb * A Lost prop, ram is lit* I. up, deve Loped to provide insulation, 
packaging, venting and installation design dal a lor all insulated 
fluid lines, particularly polyurethane loam insulations and TC-15000. 
3. 1.1. 6 Crew Compartment Pressurization and Toxic (ias Control 

The pressurized crew compartment has a volume of approximately 
70 m^ or 2300 ft.*, and contains three levels. Hie upper section, 
or flight deck, the mid-section containing an airlock, avionics and 
living area, and the lower section containing the environmental con- 
trol equipment. 

An atmospheric revitalization pressure control system provides 
the crew compartment and habitable payload modules with a two-gas 
atmosphere of nitrogen and oxygen. It also provides the oxygen to 
the emergency breathing subsystem and airlock support subsystem, and 
provides nitrogen for pressurization of the potable and waste water 
tanks. Table VI is a recap ol the lunct ions and per for.iance require- 
ments oL this subsystem. Also, the atmospheric revitalization loop 
circulates and filters cabin air, controls the atmosphere CO^ level, 
provides temeraLure control, and removes latent an! sensible heat 

| 

\ 

\ 



through the humidity control heat exchanger. 

+ 

Cabin pressure is normally maintained at 14.7-0.2 psia, but 
in the event of excessive cabin leakage an 8-0.2 psla regulator is 
used. Sufficient make-up gas is available for 165 minutes pressure 
maintenance at this 8.0 psia value, assuming leakage equivalent to a 
0.45 inch diameter hole. The atmosphere venting control provides for 
the relieving of excessive crew compartment pressure differentials 
whether negative or positive. This is a part of the pressure con- 
trol system. The pressurization system is not designed to handle a 
second la i lure alter 8 psia cabin condition exists. The crew will be 
on oxygen masks during emergency cabin pressure maintenance of 8 psia. 
Smoke detector units located in the avionics' bays require refurb- 
ishment every 2400 hours of operation. 

Orbit or 101 's pressurized compartment has passed its qualification 
l e sis. 

i. 1.1.7 Hydraulic Subsystem 

Hydraulic subsystem provides power to actuate the aerodynamic 
1 light control sur laces, main engine gimbals, main and nose landing 
gear, main landing gear brakes, the main engine valve controls and 
nos e wh e e 1 s t ce r i n g , 

Hydraulic power is provided by three independent, fifty percent 
power systems that provide the f-'Ui i red degree of redundancy. The 
I’ar.el was (old that this approac*' minimizes weight, power extraction, 
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,'iiul system complexity and emphasizes balanced design bo t ween systems. 

A nuinhe r of component a have been standardized through corranonaiity jin'* 
endures thus reducing the cost, development time, and logistic support. 

This subsystem is active during 1 i 11 o it, ascent and orbital in- 
sertion. It provides Lor concurrent operation ol rudder, main engine 
thrust vector control and main engine valves. The subsystem is passive 
in orbit except for a low pressure, electrically driven pump in each sub- 
system. The pump provides circulation to assure thermal conditioning. 
Activation of the subsystem is prior to deorbit burn and operates 
through reentry and landing. The main pumps are driven by hydrazine 
fuel auxiliary power units. 

Kneh hydraulic system utilizes a tvl gpni variable displacement 
pump, powered by an individual auxiliary power unit, all of which con- 
tributes to the redundancy ot hydraulic power sources. Assignment ol 
functions to each system is based upon optimum power extraction and 
distribution, maximum t light salctv, and minimum weight without segre- 
gation of flight control and utility timet ions. 

The hydraulic subsystem equipment is compatible with fluid speci- 
fication Ml 1-11-8 . Its hulk lluid temperature is maintained below 

T. by a hydraulic lluid/water boiler heal exchanger. 

The hvdraulie distribution system consists ot tubing and fittings 
lubricated from titanium. Approximately eighty percent ot t he tubing 
connect ions are ol the permanent welded type. Minimum use ot separable 
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fittings improves the system integrity. Flared tube fittings are 
not used. Metal lines, designed to flex, are uBed in lieu of hoses, 
where possible, to reduce maintenance and improve safety. 

Metallic , run-elastomeric and elastomeric seals are used as beat 
suited for individual applications. Because of the upper temperature 
limit of 275° F., elastomeric seals can be used where they offer 
advantages over other sealing techniques. Experience with aircraft 
hydraulic systems has also demonstrated that satisfactory system 
operation can be achieved with non-elastomeric and metallic seals. 

A hydraulic subsystem working pressure of 3,000 psi was selected 
on the basis of minimum cost, minimum risk and better stiffness quality. 
The system is capable of operating when subjected to normal g, zero g, 
and hard vacuum encountered in orbit. 

The three fifty percent system configuration (fail-safe) was 
selected in preference to an original design of lour fifty percent 
(lai 1-operat ional/fai 1-sale) configuration as a result of an exten- 
sive study of historical failure data of hydraulic components, the 
limited operational exposure time during ascent (abort decision time) and, 
of course, weight and cost savings. 

from the point oi view ol reliability, the system requirements 
stale that the hydraulic subsystem shall provide safe flight and 
landing in * he event of any single failure which causes loss of one 
hydraulic string (mil-sale). The avionics/hydraulic interface is 
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required to have a design that is two la i lure tolerant (lail-oper- 
at lonut/ fall-safe) . The subsystem also has a maintenance requirement 
that it be consistent with the turnaround operation and be capable 
ol being maintained in the horizontal as well as vertical posit on. 
Aerosttriace controls operated by the hydraulic- system are shown in 
Figure 16 . 

The hydraulic- subsystem interfaces with the following space 
orbiter subsystems: 

(a) Flight control surfaces - elevens, rudder, speed brake, 
and body flap. 

(b) Main engine thrust veclor control. 

(e > Utility loads. 

(d) Steering, and landing gear brakes. 

(el •'.bionics - displays and controls, and flight control 
elect ronics . 

Actuators usc*d in the l light control subsystems (elevens, main 
propulsion system thrust vector controls and landing gear) have been 
approved by Rockwell International, Space Pivision, as acceptable risks 
based upon the very low probability ot rupture or mechanical binding 
modes ot lailure. 

While the Panel has not had t he oppoi t util i t y t o review tills area 
in depth, the lollowing questions would appear appropriate based on 
experience with other systems: 
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^ font are failure isolation techniques, such 

(a) To what extent are ran 

. a - Kroakers and return line chock 
as hydraulic fuse, hydraulic clrcuir breakers. 

valves used to Isolate a tailed component. 

(b) It h a. been a general rule that whenever hydraulic 

p 0w er is necessary for critical safety if. two independent sub- 

, uviv is this not the case for the Orbiter? 
systems are used. Why 

0 rhat sufficient fluid cooling i8 

(c) is there assurance that auntie 

„. hW fluid and seal temperatures? 
available to maintain compatible fluid 

fl relating to actuator failure modes and 

(d) What parameters reiati g 

. the approach and landing test 
life expectancy are being measured on the appro 

.a for the first vertical flights? Does 
vehicle and on the Orbiter used tor 

, a l exist so that these measurements can be related 
a mathematical model exis 

. jnta to further enhance hardware 

to the design and component tes 

verification^ ^ wdes of the hydreullc subsystem result 

ln the loss of the Orbiter - either direetly or through the failute 

(0 what is the method of validating these systems to 
achieve the neeesset, eenffdenee , the design selected by -a/koek- 
well international. In other words, H the testing is not y 
m , expected conditions, bow valid Is the risk acceptance logic 
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(g) What specific hardware/management controls are placed 
on the designers and manufacturers other than the prime Orbiter sub- 
contractor? 

3 . 1 . 1 . 8 Orbiter Separation Systems 

The separation of the Orbiter from the External Tank involves 
three separation systems: (1) forward structural attach, (2) aft 

structural attach, and (3) Orbiter/ET umbilical plate separation, 
including the electrical umbilical separation. See Figure 17 . 

Separation from the carrier aircraft (Boeing 747) involves for- 
ward and aft structural separation areas that are different from the 
Orbi ter/External Tank arrangement, but the method of separation is 
essentially the same. See Figure 18- 

The forward structural at loch/separation configuration consists 
of a dual piston pressure actuated frangible attach bolt coupled with 
a standard nut. Each piston can fracture the bolt at the Orbiter 
Thermal Protection Subsystem moldl i ne utilizing pressure generated by 
one of two Apollo- type pressure cartridges. Subsequent to separation, 
three centering plungers/springs align the bolt separation plane with 
the Orbiter TPS mol.li.no by rotating the retained portion of the bolt 
within the Orbiter. No close-out door is required since the stub bolt 
and Sj'her ical bearing are essentailly flush with the TPS moldline. 

The all structural at t aeh/separat ion configuration consists of 
two (right and lelt side) dual detonator t Tangible mils coupled with 
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two correapoullng attach bolts, Kach bolt has u retraction spring 
which, after nut fragmentation, retracts the bolt into the ET hemi- 
sphere so there will be no interference in the separation sequence. 

On the Orbiter side, the dual Apollo-type detonators are enclosed in 
a cover assembly whose function is to contain nut fragments and hot 

gas generated by the operation of the detonators, either of which 
will fracture the nut. 

The Orbiter/ET umbilici plat. ..par. tip,, configuration con.i.t. 
Pf two aaaembliea (rl s ht and left stda) . Each ass<!nlbly contalna 

three dual detonator frangible nut/bolt combinations which hold the 
Orbiter and ET umbilical plates together during mated flight. Each 
bolt has a retraction spring which, alter release of the nut, re- 
tracts the bolt to the ET side of the Interface. On the Orbiter side 
each frangible nut with its Apollo-type detonators 1, enclosed in a 
debris container. Each Orbiter umbilical plate has three retractars 
which, after release of the throe frangible nut/balt combinations, 
retract the plate approximately two and one-half Inches. Retraction 
motion does a number o, things: «) di.connects the Orblt.r/ET elec- 

trical umbilical in the first halt inch of travel. (2) releases the 
•rapped fluids between the Arbiter and the ET oxygen and hydrogen 
shutof, valves, and <:,) serves as a backup tor closing the oxygen and 
hydrogen shutoff valves. Each Orbiter umbilical plate has three 
stabitztng hunger's to hold it in position after separation. 
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The questions that would seem most appropriate at this time 

are : 

(a) During separation of the Orbiter and External Tank, 
propellants are released from the feedlines. With hot surfaces, hot 
wires and so on, what is the potential hazard of the oxygen and hydro- 
gen being ignited? 

(b) What is the adequacy of the separation system and the 
operational procedures to assure a safe physical separation of the 
Orbiter and External Tank under nominal and non-nominal flight con- 
ditions? For instance, all separation modes normally require the 
use of the forward Orbiter RCS operation, assurance that the sep- 
aration of each of the three points to be separated are done within 
the required time period. At what point during thrusting by pro- 
pulsion units of the total Shuttle system can separation occur? 

(c) What is the hazard of the Orbiter and External Tank 

recontacting after separation? 

(d) What is the ability to maintain the oxygen valves 
and hydrogen valve in the open position up to separation and the 
ability to assure closure alter separation? 

(e) What is the basis tor confidence that there is no 
potential hang-up problem at the att structural separation inter- 
lace alter the attachment holt is retracted? 

(f) Since umbilical door release is accomplished through 
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the use of a spring-loaded latch on the External Tank, what Is the 
hazard from door, door hinge, or latch failure? 

3. 1.1.9 Structures 

The Panel has not examined the basic Orbiter structure in any 
detail but has opted to look at those items from the standpoint of 
the test program used to validate the structure. The TPS and doors 
are covered under separate sections of this report. Another view of 
the Orbiter structure is obtained from an evaluation of the interface 
between the Orbiter and the External Tank and the Orbiter interface 
with the Main Engine. Added to this is the examination of the abort 
operations' area which includes an understanding of the ability to 
meet intact abort modes requirements. 
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3. 2 Space Shuttle Main Engine 

The Orblter Main Propulsion Subsystem consists of the Space Shuttle 
Main Engines (SSME), the External Tank (ET) which stores and supplies 
liquid oxygen and liquid hydrogen for the SSME’s, and a system ol valves, 
plumbing, pumps, etc, located in the Orbiter which deliver the pro- 
pellants to the engines. 

The three, main engines are started during the countdown. When 
they attain a ninety percent thrust level, the Solid Rocket Motors are 
ignited and liftoff is achieved. During the burn of the engines, they 
are throttled as required to limit vehicle acceleration to 3g. Gim- 
baling of the main engines provides steering during ascent in con- 
junction with Solid Rocket Rooster thrust vector control. The SSME’s 
burn for about eight minutes. Final boost into orbit is provided by 
the Orbital Maneuvering Subsystem (OMS). Each of the three main 
engines is approximately fourteen feet long with a nozzle about eight 
Loet in diameter. The engines produce a nominal sea- level thrust of 
3/3,000 pounds each and a vacuum thrust of 473,000 pounds. They are 
throttleable over a thrust range ol titty percent to one-hundred and 
nine percent of the nominal thrust level. 

Orbiter interfaces are basically of three types - fluid, electrical, 
and structural. The fluid connections consist of the main propellant 
lines which transmit liquid hydrogen and oxygon and the fluid connections 
located at the interlace connect panel mounted on the vehicle. These 
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provide fluids to and from the individual engines as follows: 

(a) Hydraulic supply to and from the engine. 

(b) Nitrogen purge (ground) to the engine. 

(c) Helium supply to the engine. 

(d) Fuel and oxidizer bleed from the engine. 

(e) Gaseous fuel and oxidizer (presaurant) from the engine. 


The propellant fluid connections at the interconnect panel con 
sist of bolted swivel flanges. All remaining fluid connectiona are 
attached with bolted flanges except for the hydraulic system which 
uses self-sealing quick disconnects. Flexibility for these joints 
are provided with flex hoses on the engine side of the interface. 


Electrical interface between the engines and the Orbiter are 
made at the electrical connect interlace panel located on each engine. 

These interfaces consist of the following: 

(a) Single 28 vdc power connector. 

(b) Two 115/208 vac power connectors. 

(c) Three communication and data transmission connectors. 

AG power of 115/208 volt, 400Hz, J-phasc, is supplied to the engine 
controller and the controller conditions the power to the require- 
ments of the various engine actuation and instrumentation subsystems. 
The 28 vdc is provided to operate both the SSME controller heaters 

and a redundant coil on each engine's emergency pneumatic shutdown con- 
trol solenoid valve which is normally open. Engine shutdown cannot 
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occur when the crew activates the engine limit control to inhibit 
engine shutdown. Operational and checkout, commands and engine I light 
data are supplied via the electrical interface connectors at the 
engine-supplied electrical interface connect panel. Commands con- 
sist of engine start, shutdown, thrust level changes, checkout, and 
sequence checks. Engine flight data to the vehicle consist of infor- 
mation necessary for malfunction display, fault Isolation, maintenance 
recording, trend analysis, performance monitoring and checkout. Three 
parallel redundant connectors provide a path for the Orbiter-to-engine 
commands. A minimum of two of the three commands must be received 
before the engine response can be initiated. Two of these connectors 
are also employed to transmit the engine flight daLa back to the 
Orbiter. The alt Orbiter thrust structure, the third interface, is 
built up with a titanium/boron epoxy material. AnoLher interface is 
the honeycomb-base aluminum heat shield with insulation to protect the 
SSMK from thermal inputs. 

Integrated testing of sul systems is a critical milestone in the 
SSME program. It will be conducted at the National Space Technology 
Laboratories (NST1.) in Mississippi. l”he first engine firing at rated 
power level will take place at NSTL on a modi lied Apollo tiring, test 
stand in the winter cf 197^. litis will be followed by the first 

throttling lest over the rated power level range. The Integrated 
System Test bed (ISTB) will demonstrate the design's ;• lity to handle 
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the high pressures nnd repeatable operations required of It. The 
ISTB engine configuration varies somewhat from the flight-type 
engine In the following areas: there is no LOX lank pressurization 

heat enchanRer, changes in material (high pressure fuel line, small 
fluid lines, powerhead ducts , and modified insulation), and the 
electronic controller assembly is not a flight type unit but is a 
bench test unit built in racks. The ISlu has progressed as follows 


Assembly completed 

1/13/75 

Checkout completed 

3/21/75 

ISTB shipped 

3/25/75 

ISTB at NSTL 

3/28/75 

ISTB installed at NSTL 

4/7/75 

Test Readiness Review 

5/7/75 

ISTB first firing 

June 1975 


There is no g imho ling planned during the ISTB program. 

3 . 2 . 2 Subsystems Critical to Crew Safety 

For the purposes of this report, the Space Shuttle Main Engine 
as a system is divided into the following subsystems: 


(a) 

Combust ion 

devices 

(b) 

Tu r bo - ma ch i no r y 

<o 

1’neumalics 


(d) 

l’rope 1 loot 

valves 

(o) 

Hydraulics 
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(l.) Controller 

(g) Igniters 

(h) Klerl r leal. harnesses 

(i) Instrumentation 

( j) Interconnects nml SSMK/orb tier Interlaces 
(k) Cimbal 

As wiLh the Orbiter el emu tit ol the Space Shuttle program, Lhe 
Panel recognized that any one or a combination ol these subsystems 
and their components may be considered as affecting crew satety, but 
from the point of view ol the Panel it was necessary to determine 
which of these should be focused on during the review period. The 
basis of this focus was(l) on subsystems and/or components extend- 
ing the technical (material, fabrication, etc.) state-of-the-art in 
the literal sense or in the application, (2) those subsystems and/or 
components which prior program "lessons" have indicated as areas oi 
concern, (3) areas which the Panel members considered most vulnerable 
to "human error," and (■'» ) areas which can at feet crew safety but which 
cannot or will not have been adequately tested or validated prior to 
first flight. With these criteria in mind the Panel examined the 
following subsystems in some detail: 

3. 2.2.1 Kngine Klee ironic Controller Assembly 
t.2.3.2 Main 1 ‘omhusli.on chamber 

3, 2. 2.3 High Pressure liirlio- Pumps 
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3. 2. 2A 


Heat Exchanger 


3. 2. 2. 5 Hot Gas Manifold 

The Controller is significant for crew safety because of its 
responsibility for detecting, moniLoring, and controlling engine 
failure, thrust and propellant mixture ration, and engine starts 
and shutdowns and engine gimbaling. 

The manifold, exchanger and chamber are of particular signifi- 
cance because they have complex welds and are subject to hydrogen 
embrittlement during operation. Material safety factors may be re- 
duced through flow erosion or fabrication problems. Finally, it is 
difficult to inspect the finished item. 

Also, the Panel reviewed the following areas to assure that risk 
assessment was receiving appropriate attention: 

3 . 2 . 2 . b POGO 

1.2.2.7 Ground Operations and GSE 

3. 2. 2. 8 Hydraulic Fluid 

3. 2. 2. 9 Lightning Effects 

POGO results from dynamic coupling of the structure, propulsion, 
and flight control subsystems during all phases of powered flight 
under all possible payload variations. Thus POGO suppression hard- 
ware has had to be designed to eliminate coupling and the resultant 
structural instabilities. 

Ground operations and ground support equipment are being developed 


80 


to discover failures and predict malfunctions before they occur. 

The Panel had asked the Program to review its use of "red oil" 
hydraulic fluid and consider alternative hydraulic fluids that are 
more fire resistant. The Program has made a change and the Panel 
reviewed the new choice . 

Lightning was a concern because of its impact on such subsystems 
as the Controller. 

3.2.2. 1 SSMF. Controller (Electronic Controller Assemblyl 
Systems Design 

The SSME utilizes a lull-authority digital electronic control 
with hydraulic servo-actuated valves. The Controller operates in 
conjunction with engine sensors, valves, actuators, spark ignitors, 
harnesses, and an operational computer program (software) to pro- 
vide a self-contained system for: 

(a) Closed loop engine control. 

(b) On-board engine checkout. 

(c) Engine limit monitoring. 

(d) Engine start readiness verification. 

(e) Engine start and shutdown sequencing. 

(f) Engine maintenance data acquisition. 

The engine/controller functional relat lonships are shown in 
figure 19 . The controller electronics arrangement is shown in 
figure "N . In that same figure is shown the responsibility of the 
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two Honeywell organizations. 


(.hnracteriatlea oi the Controller oi. interest are: 

(a) Overall dimensions 23. V 1 x 14.5" x 17" 

(b) Wei,. hi 197 pounds 

(0) Input power 4 72 watts to b36 watts 

(u) convective cooling (primary mode) 

(e) Temperature environment operational -50° to + 95° F. 

Non-ope rat ional - 200° to + 200° F. 

(1) Vibration environment sine 24 p's peak 

random 22.5 p's root mean square 

(g) Unit is mounted on engine using a three-point hard-mount. 

Hie eleetrieal harness assemblies between the engine interlace and 
the tout roller are oi two types - conventional and llexible armored, 
convent ional harness is used where redundant electrical inactions are 
earned through separate connectors and will l»e physically routed 
independent oi each other. Flexible armored harness is used where 
redundant electrical l unctions cannot be physically routed separately. 

P anel's Initial Review 

t i ioi to reviewing the Controller program, the Panel requested 
spec it i c intornuit ion as background data on this critical hardware. 

Iltc documents reqmsted were (l > reliability analysis and test data 
that documented the Font roller con t igui a t i on and its projected ability 
to support mission objectives, (.-) prediction analyses tor t lie ex- 
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peeled mpoq* l; Ime - be l ween failure taros am, the basis „„„„ wU i cU suth 
predictions were (J) trade-olt studios between the (;<1 , ltroUt . r 

uainp plated-wire type mottle, and a design using the latest or the 
traditional type tores, 'this material was received and re- 
viewed by the panel and staff. Typical data included in the response 
is shown in Tables VI I io IX 

the Panel then undertook a series of inspections. 

Status of the Controller program in the early summer of 1974 
looked like this : 

(a) Design verification tests were completed on the input 
electronics, output electronics and the computer interface electronics 
r»c digital computer processor logic was proved through the use of a 
Honeywell HlXf-OOl computer uni, and on the engineering and bench test 
““ controller assemblies. The digital computer memory design, in . 
eluding the use of plated-wire, was prove,, through testing of a "half- 
stack ut.tt. The halt -stack test was a test using a rack-mounted 
integrated memory assembly. The don, roller power supply „a, „„der- 
going expedited documentation (specifications, etc), procurement, 
labrital ion. At flic same lime power supply breadboard tests 
Showed that there were numerous problems with the desfgn. gome 
■He Problems associated with the subsys, em/c trcnit/compon.nt items 
were powet supply voitage below mtnlmnm allowable rlpple> 

'“ 11,,r " inter board pins and 


sockets pulling out, deflecting or not matching. SM-1 (structural 
model) vibration testing had revealed foam retention and sen! problems. 
There were parts problems with integrated circuits and connectors. 
Integrating the digital computer unit components was a problem as was 
the integration of the total Controller, Noise in the memory and 
parity errors in the computer unit also were concerns at that time. 

Thermal design of the package was verified by analysis and tests 
on the structural model (SM-1), which was not, of course, exactly 
like the flight design. However, given the excellent correlation be- 
tween analysis and test results and the piece part temperatures and 
conduction rates to the case, there was sufficient margin remaining 
in Lhe design to allow ior product ion process variables and for some 
modi t icat ions . 

Vibration tests were conducted with the SM-1 unit which verified 
that the general packaging concept would meet the requirements. Prob- 
lems surfaced with regard to the case aluminum seul which leaked, 
excessive resonances in some of the parts, and the retention ol the 
halt-stack card and loam assemblies. Solutions lor these mechanical 
problems were locul filed but lurlher testing was necessary to prove 
that the solutions would actually work. I'nvi roumenlal test tor salt, 
humidity, etc. were to be conducted. IVsign verification testing tor 
thermal conditions was to be conducted on the memory boards, printed 
wire boards , and master interconnect hoards. 


A necessary adjunct to the development of the Controller hard- 
ware and software are the many test Items and facilities which prove 
design and fabrication concepts and validate the prototype and flight 
hardware. The software verification facility was operational, the 
design tor the command and data simulator design complete, and hard- 
ware test equipment of many types were built and in use. Such test 
equipment as "automatic wiring board test stations", "power Supply 
Conditioner Test Unit," and "Memory System Exercise,*" were proceeding 
satisfactorily. 

Software design was demonstrated on the Controller engineering 
model and the bench test units. The electrical interface between 
the engine and the Orbiter was verified as was the ability of the soft- 
ware to conduct engine start, muinstage control, and engine shutdown. 

At that time the computer acceptance test program design was com- 
plete and 957. debugged, the Controller acceptance test program base- 
lint- design was complete but not debugged, and the operational pro- 
gram design was complete with 507 of it coded and debugged. 

There was adequate experience with the development of the plated- 
wire memory to warrant confidence in the technology. However, there 
did not appear to be an understanding oi the fundamental physics to 
assure that surprises could be anticipated and a timely course of 
resolution decided upon and implemented. It additional surprises did 
occur, they probably could be solved by trial and error, given sutli- 
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CUnt b,,t 9ur P rl »<'« ““'hi probably Impact the the, very 

tlKht achrtlule requirements. At that time the half-stack test of 

the rack mounted Integrated memory syatem and the at, net oral thermal 
verification program mere completed. Fabrication Improvement was 
indicated by the acceptance trend of plated-wlre aasembllcs. 

While there was no single reporting format available which 
systematically stated the significant lessons learned from the viking 
program and their disposition with regard to the Shuttle program, the 
new program manager had his staff review the minutes and audits from 
numerous Viking reviews and identify specific actions. As a result of 
this review, design changes were incorporated into the Digital Computer 
Uni.. Pally production schedule reviews were Instituted with closed 
loop corrective action and follow-up f ot all problems defined. The 
process spec i flea, Ions and the training program lor the prodnetioa 
and inspection workers were strengthened. Management and supervisory 
hills made 11 their business to have more contact with the total 
Viking and Shuttle personnel. Viking audit disciplines were In- 
corporated into the Honeywell basic management and technical system. 
ill front Suit ns 

Miuo it* initial review in the summer 01 1974, the Panel has 
i \aini tu il the amt its rout roller in September 1974, January 197S, 

,,Ul A ' ,ril l97S * l1U ‘ l ‘ UriVm ^ontrollor status as soon from those ro- 
viows looks liko this: 
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(a) SM-l (structural model) thermal and vibration teats 
have been completed and the structural and thermal math models have 
been verified. 

(b) The breadboard controllers BT-1 and KM-1 have been In 
use and the Controller functions such as start-up and shut-down have 
been demonstrated. 

(c) The command and data simulators have been used ex- 
tensively as have the Controller checkout consoles and laboratory 
model computer used in the integration of the. Controller subassemblies 

(d) The digital computer unit number SN-1 has been com- 
pleted and integrated in the first prototype controller, PP-1. 

This unit, however, has experienced intermittent parity errors which 
are under study at this time. All of the Controller functions of the 
PP-1 have been exercised and some ouL-ol -speci f ication conditions have 
been surLaced which also are being examined for proper resolution. 

(e) The quality of the workmanship and inspection system 
has been improved, with the result that the rejection rates for such 
things as plated-wire memory boards has been reduced to a very 
acceptable level. 


(I) The BT-1 unit, to be used with the SSMC Integrated 
System Test Bed test program, was success fully cheeked in March 197S 
and has been delivered to NST1. for installation into the ISTH ta- 
eility. SSMK to Orbit or interlace documental 


ion (IU> lJMlMHH)) has 



been issued and is under standard control of the configuration control 
system and the interface working group. 

(k) Operational philosophy lor "out of limit" signals has 
been defined and agreed to as shown by the current design. This 
design provides for engine sensor inputs to be out-of-limits three 


consecutive check periods before the input is "declared" failed, which 
is called a "three strike" concept. A part of this system provides 
for rechecking critical parameters inmediately during the same major 
status loop check. A major status loop check takes about twenty mil 
seconds. I.ess time critical parameters are rechecked during the next 
two major sense-reporting cycles. At the same time the out-of-limits 
data are not used by the engine control system at that time. For in- 
ternal Controller parameters the "two-strike" concept is used in which 
two consecutive out-of-limit conditions must exist before that item is 
declared 'tailed." Short tern anomalies will not cause pre-mature 

loss of redundancy, o.g., shifting to (he second computer section of 
the Controller or engine shutdown. 

(h) The power supply units tor use in the PP-1 and PP-2 
Controllers have been completed and tested satisfactorily. Design 
verification tests have been conducted, resulting in a low degree of 
electromagnetic interference beyond specification limits. This does 
not appear to be a major problem. 

(i) Maater Interconnect Hoards, because of their complexity. 
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have* posed numerous production problems. Four have boon built lor 
use in the PP-l and PP-2 units in addition to the development units. 

To date the development teats have been completed. Manufacturing pro- 
cesses along with alignment fixtures and insertion tools have been 
established. The design verification test hardware is being built. 

A problem still to be resolved is the noise being coupled into the 
memory sense lines due to wire routing and inadequate shielding. 
Modifications are being incorporated to add sense-line-shielding on 
the Master Interconnect Hoard and to reroute control sense lines. 
Additional improvements are being evaluated in case they are needed 
in the wiring approach to the memory area of the board. 

(j) Four memory systems have been built lor the PP-l and 
pp-2 Controller units and twelve half-stacks have been built and 
tested. Several hours ol memory operation have been accomplished at 
the digital computer unit level. There have been intermittent parity 
errors, and a noise problem has been identified in integrated testing 
ol the Controller. In addition to the tixos to the Master Interconnect 
Hoard, changes to increase the memory plane shielding and plated-wirc 
output are being studied in order to increase the signal to noise 
ratios. To put the parity error problem in perspective, the extent 
of the testing on the two memory channels should be considered. Channel 
"A" operated over the temperature range at the digital computer level 
tor eight hours with only a single occurrence ot parity enor. Channel 



"H" had error- free operation over the temperature range lor some V+ hours 
at the memory system level of Installation, and approximately 100 hours 
of operation at room temperature with comparatively few intermittent 
parity errors at the Digital Computer Unit level, 

(k) The basic software element 8 and/or routines are as 

follows : 

Executive 
Ground checkout 
Self- test 
Start preparation 
Power range control 
Vehicle commands 
Limit monitoring 
Sensor processing 
Output monlLoring 
Fa i lure response 
Post shutdown 

Constraints on the software programs are the memory size ot lt>,J8& 
words and the Controller major cycle time ot JO milliseconds. In 
IVccmber 1974 Lhc memory capacit was exceeded. As a result there 
is an etlorl at this lime to reduce the word requirement by proper 
sot t ware programming and or some reduction in requirements. At this 
time the emphasis is on meeting the SSMK Integrated Subsystem Test 
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IW'cl program. MSKfJ noted tluil considerable eflorl has been placed on 
providing the* proper soliwnri'. For example, the contractor established 
a whlU operation , hchedul.es are also established and progress is 
reviewed on a daily basis. "Memory scrub groups" have been established 
at: Honeywell, Koeketdyno and NASA. 

3. 2. 2, 2 Combustion Devices 
Systems Desiun 

Ihe function of the Main Combustion Chamber is to contain and 


direct the forces of combustion generated by the burning of the pro- 
pellants. The hot gases are accelerated to sonic velocity at the 
throat and supersonically expanded to an area ratio of 5;1 at the 
interface with the engine main nozzle, The Main Combustion Chamber 
consists ol a structural outer jacket, regenernt ively cooled liner, and 
inlet and outloL manifolds. Two thrust vector control struts are 
attached to it as are mounts for the engine electronic controller 
assembly. The Main Combustion Chamber fabrication problems or con- 
corns are similar to those described lor the hot-gas manifold unit. 

In addition Lho cooling of this combustion chamber requires a rate of 
heat removal three times higher than any previous liquid fueled engine, 
100 blu/ LI "/sec. The number o! welds used in producing the chamber 
are about 112 ol which 1(> are elec iron beam welds. 

Current Status 


Main engine eombus i on devices have had fabrication problems dur- 


I up, their development period. Main combust ion Chamber ami nozzle 
I a hr I cal Ion has been eomplct ed In support of (lu* Infeprated llyiili'm 
Test llfil prop, ram hardware, inelndinp, imnvsHl it 1. prool -( cut Inp, to l,?. 
Ilmen the raied -power level opera I (up, rood li Iona, or a ho it l t»HOO pal. 

The .nip, men l ed spark lp.nl ter has been denumni rated success lolly , in- 
rlmllnp, a MX) second run at lull power level, conditions. Suhseale 
'node 1 o| the main injector (/»(), 000 pound thrust unit) has been demon- 
strated. Hot fire tests have been conducted on the oxidizer pre- 
burner and the luel preburner, which all appear to meet performance 
requirements, l-’low induced vibration was noted in sonic of these 
tests, lmt this apparently lias been remedied. Liu* 1,0X tank pressuri- 
zation heat exchanger, located in the I .OX side of the hot p,as mani- 
fold assembly, is a critical item in the engine combustion system, 
flic present heat exchanger design requires ripid manufneturi np, and in- 
spect ton control and verification testinp, to assure an acceptable unit. 
Kockeldyne tecls that this can be accomplished. 

) . . 2 . 1 Turbomaehines 
Systems Hcsip.n 

llu- h ip,h-pressure fuel turbopump receives fuel from the low- 
pressure luel pump and boosts the pressure to the level required for the 
pre-burners. The Kiel is then diseharp.ed throup.h the hip.h- pressure 
Kiel pump discharge duct to the main Kiel valve. This l urhopump con- 
sists at a tluec-stape ccntrllup.nl pump drive by a twe-slap.e reaction 


Hu bin**. Our prop** ] lnm coiul J.i ion) .up, , t lu* liitoli seal is closed 
nr.nmd l ht* pump shall, preventing I.II-, Horn flowing Into I h*> itubine 
nn*n ami nut through l lu* hoi -gas man It old in i In main In (eel or, M 
engine hi ail , (he J.i 1 1 oil sea I in actuated by i lie |utm|) pressure al 
a pump speed ol approximately 7000 rpm. Iiurin,; mai milage firing, 
l lu 1 pump ivails to l li rot l 1 lug rommands by ehaiigi up, dtseharge pressure 
a»»l ilowrate. 'Hu* liu-ofl seal. reseats when the pump pivmmrc de- 
irmtsi's lo a .speed ol 7000 rpm. 

Hie high-pressure oxidizer turbopimip receives oxidizer from the 
low pressure pump and boosts tin- pressure to a sutlieient level to 
provide adequate t low- rale and pressure to the thrust ehamber and tin* 
preburners. I.ngine start activates the pump intermediate seal purge 
that provides an inert barrier between the pump and turbine during 
ope rat ion . 

Current Status 

Material presented to the Panel indicates that the turbine nozzle 
eastings and turbine strut forgings around the turbine have been the 
major problem areas, 'flu* initial vendor was unable to cast the 
noz.lcs due to shrinkage, failure to till molds, and erratic material 
problems. I'o resolve the problem quickly, a change in vendors was 
made in duly l')7 i 4 and nozzles weve sueeess l tt 1 1 v cast using a new 
mat e ti a t ( I Nt 0 7131,1 instead ot MAK-M-J.'uO . It turned out (hat the 
lite i in the 71 M.t type nozzle easting, was inadequate. Work was te- 


su med on the use of tho original material «"d It was £o-nd that the 
now supplier was in fact able to produce successful nozzles with 
HM-M- 246 material that now appear to meet the turbine noaale require- 
ments. these nozzle castings are still receiving MSFC's attention to 
assure adequate hardware 1. available for the earl, engines in the SSME 
program. The turbine inlet struts had some material problems regard- 
ing acceptable axial strengch of the forgings, lhls problem has been 
resolved end the forgings are adequate to meet program needs. 

3.2. 2.4 Heat Exchanger 
System Design 

The heat exchanger provides oxidizer gas pressurant for vehicle 
LOX tank pressurization. This heat exchanger is a multipath, single- 
pass. cross- flow device installed in the Iff aide of the hot-gas mani- 
fold at the high-pressure oxidizer turbopump turbine exhaust. The 
supports for the heat exchanger tubes are mounted to the liner wall so 
ns to allow small movements during expansion and contraction of the 
tubes. The tubes enter and leave the hot-gaa manifold through flared 
projections of the manifold liner. The flared projections provide stag- 
nant gas pockets for reduction of thermal stresses at the tube-to-oxyger. 
manifold attach welds. The heat exchanger is depicted schematically in 
figure n . The major concern here Is with the heat exchanger coil 
material and its ability to be assembled and then to remain virtually 
leakproof during its operational life. For Instance, a leak could 
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permit •* — - h0t «** “ 

„«y s e„ aupply Uae « h “ l 

tR „Ulon that .ould nlao M. a„ adjacent ‘"• ll “ r ,,w """ 

iold wall. 

Our rent Status 

„ >e a..!*, amt aatnuiactorlnr. approach bcinti oaed to redaoo tha 

poaBlbfUty ol thta hazard include a number of actiona. 

An ultimate factor of ante,, of 1.75 is used rather .ban the 

, u i> „| 740 c voles normally i 8 required* 
usual 1.4. Where UtiRuo lUc ol .4» 

1 . „ 14 r 50 e voles tor bLCurcution joints, to 
Lhis has been increased to 14 >0 cycles 

ii mints and to 2b, 000 cycles Lor parent metal. 
4500 cycles lor weld joints, ami » 

. i..«m will include leakage checks. 

Design veril teal ion structural usis w 

ultimate pressure, and low cycle 
vibration, proof pressure iVcUs, ultim. i 

laligue tests. 

guality control o« componou. a will uac ultraaontc. penctraaf and 
he l turn leak fcafa (1 a 10 “ arc/acc a, limit Preaaurca).^ 

tho Panel »c «• ■ 1 "“" ‘ ' “ " 

acc/acc a, limit prcaaurca no, Inf. that fhia ,eaka,,c rate appeared 

excessive in determining the acceptability ol the heat exchanger. 

llils is being reevaluated at this l iim * 

A Modification he, ay. conaldered .« .he UK preaauran, control 

ayatem which would or fhe dfacharf.c up- 

l he Orbit er flow ctuffrul whtch would In.ure valve 
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lnltM pressure being above the hol-gas iwnll'oW pressure. 
:t,2. 2 , 5 Manifold 


Svatem IV sign 

Liu' hot-gas manifold serves as the structural nucleus of the 
engine and provides gas passage interconnection lor the preburners, 
high-pressure turbopumps, and the main injector. Hydrogen- rich hot 
gas (hydrogen and oxygen) flows through this muni 1 old and then into 
the main injector, tooling of the hot-gas manifold is accomplished by 
using double wall contraction (a structural outer wall and an inner 
liner). This provides a flow path for hydrogen gas coolant exhausting 
,rnm the low-pressure hydrogen turbine. This con! igural ion isolates 
the structural wall trow the hot gases flowing within the inner liner. 


Current Status 

This hardware is lubricated with complex weld which has required con- 
siderable ln-process rework at the lubrication location. Critical to 
achieving successiul weld is the alignment ot the Joints and the 
materials and processes developed lor such welds. Proper alignment 
ivdtues the stress concentrations and discontinuities that normally 
cause problems in welds. All manitolds are analyzed tor weld 
adequacy. fo lurther reduce induced stresses, prestrainlug and an 
annealing, heal treatments are utilized. Hydrogen- rich mixtures, 
particularly at high pressures mp to uOOO P si in part ol the englue), 
leads to the possibili.v ol metal embrittlement problems. The 


1 >«im rt 1 1* l Li t v ol iTdckti, warpage ami structural lailuri’H obviously allecl 
the engine opcrat ion <nul performance I rain simple guH leakage to engine 
shutdown, ami in extreme eases potential all compartment lire or ex- 
plosion. based on ( he material provided t o the Panel, NASA and its 
eont raetor are aware ot those problems and eonlinuo to place very 
heavy emphasis on eliminating the fabrication anil material problems, 
and on the test program to validate the design and manulaet nr ing 
processes . 

.1 . 2 . i . t> POU) Suppression 
The Problem 

POtIO is not only an SSMP problem hnt also must be viewed t rom 
a "systems" standpoint. The discussion here deals with the hardware 
as currently designed and as attached to the SSMI's themselves. 

Systems integration aspects are covered in more detail in Section n 
ol this volume. The Panel's concern with I’OUO etteets goes back to 
Saturn V launch vehicles in the Apollo program. Most large, pump- 
ted rocket vehicles have had moderate l o severe long! t ml iua 1 oscillations 
caused bv IWO instability. Such oscillation can result in an environ- 
ment severe enough to cause structural damage ami attoct crews physio- 
logically. PtktO is a closed-loop phenomenon involving l luld- l oed- svst cm 
pressure oscillations which result in engine thrust perturbations and 
structural motions. These mav be visualized as beginning with small 
vehicle accclcrat ions that produce variations in propellant pressure 
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nnd flow rates, which In turn cause thrust variations, rt juicing In 
increasing vehicle osctllationa. 

Elements of the Space Shuttle Vehicle system involved in POCO 

are : 

(a) Long liquid oxygen supply line. 

(b) Asymmetric Shuttle structure and thrust vector couples, 
and coupling of flight control and POGO instabilities. 

(c) Main propulsion system (SSME's, ET, etc.) which oper- 
ates from liftoff to orbit with extreme changes in vehicle structural 
characteristics and turbo-pump inlet pressures. 

(d) Space Shuttle's main engines themselves, with their 
LOX and LH 2 high and low pressure dual pump systems. 

The depth of NASA and contractor efforts to assure that POGO 
docs not become a Shuttle operational problem can be seen in planning, 
documentation, testing, and analytical work being performed to re- 
solve this concern, litis includes the "POGO Prevention Plan" JGS 08130, 
dated January (>, 1971, as well as studies to determine the need for 
POGO suppression, and to add the suppression system. Such groups as the 
POGO integration Panel and the independent MS KG POGO analysis team, 
have boon working this challenge. 

Suppressor design requirements have been defined as follows: 

(a) Location its close as practical to 'he High Pressure 
Oxygen Turbo-pump. 
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(b) Volume about O.b cubic feet or equivalent with abil- 
ity to increase to more than one cubic loot if teat program indi- 
cates this to be necessary. 

(c> Damping of tluid surges (frequency of pulses) over a 

_t * ;> 

broad frequency range; luertance less than 1.1 x 10 aec /In 


(til Minimal fluid pressure-drop In the suppressor . 

Comparison between the Saturn V and Space Shuttle engine/ fluid 
systems is shown In Figure . The WOO suppression system and its 
components are shown in Figures .M and 2h . 

Current Statua 

POCO mechanisms are known to be complex, and a continuing ana- 
lytical program la being pursued to understand the phenomenon and Us 
Implications. The suppressor has been baselined. An extensive ground 
based program is being conducted to verily ihc design. Kx tensive use 
has been made ol Saturn data in designing the test program. Tests are 
being conducted at NSFC, Martin Marietta Company, Hocketdvne, and NSTl. 
sites. The local ion, type, siee and inertancc ol the proposed system 
have been arrived at alter a thorough design trade-olf study. Analysis 
ol abort situations and their impact on the design ot the POCO suppres- 
sor have to be accomplished to assure maximum satetv. Hut the prool- 
ol-the-puddiug can only be I ound during t light tests under actual en- 


vi ronment s . 

It appears that the 


ilqut.l hydrogen iloes not contribute to anv 


qq 


degree to the POGO problem, and there 1 h no apparent need : or a 
suppression device In the liquid hydrogen fuel system. Preliminary 
examinations indicate that the Solid Rocket Motors do not contribute 


to any decree to the POGO problem, but the analysis is continuing. 
3 . 2 . 2 . 7 Ground Operations and Ground Support 


SSME's are designed for automatic checkout and fault isolation, 
use of "line replaceable units" with good accessibility and long life 
and to accommodate the so-called "condition monitored" concept. This 
concept has as its objective the ability to discover failures before 
they occur, using nondestructive evaluation methods, and to eliminate 
premature maintenance. 

SSME controller assembly has automatic checkout capabilities for 
self-test and fault isolation to ihe line replaceable unit level. 
Working in conjunction with ground equipment, it conducts the follow- 


ing tests: 


(al Pneumatic 

(b) Actuator 

(c) Sensor 

(d ) Plight readiness tests 

(e) Redundancy verll ieal ion 

Panel interest will continue in this area to assure that ground 
operations and equipment do not adversely a fleet the engines and 


associated hardware during maintenance and preparation for launch. 



ft. followlnK .« 1 *» P ““ 1 

(a, There are no aikulflcant UK problems known .t this time. 

. n*< \hluina have resulted In quant i tat lv*- 

(b) While economic problems nav 

„..«nritative rutbacks that would 
reductions of tSSB „ there have been no quantitativ 

iffect safety. 

(c) Major GSE units have completed design verification 

testinR. 

(d) Majority of CSE components are now in service. 

3 . 2 . 2 . 8 Hydraulic Fluid 

Introduction of the ML-H-83282 hydraulic oil in place ol the 
original "rod oil" ha, boon M de at all location, worktop on the 
SSME . NSTL, MSFC, Hydraulic keaearch Company, and a. Koeketdyne. 

T o date there appear to to he no functional problem a.aoeiated with 
the use of this fluid, and laborafory feafs conffnue fo be conduefed 
to aasure that the fluid when In operational nan will mec -n- 

under all induced environments. 

3 i -» 9 i.iehtnln p, 1'roteet ion 

Thc requirement currently on contract tor UPh.nlnP protection i, 

x i i. > U Aueust 1070, "Bonding, Kleetric.nl and 
MIL- B- 5087 B, Amendment '1 au>,u»» 

Udhtnlon protect Aerospace " - - « " 

current 1 dor review, with Probability that H -U1 be 

bv the NASA publieat ion ..SOiWnU,, '>aee Shuttle Up, inf. Pro. 

..'.Uorl..- Assessments are beinf. ri„P .be May 1«> « ™ 
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with regard to lightning Mold amperage components, direct strike 
capability, launch constraints, cable shielding requirements and cost 
and weight impacts. Results of these assessments will be examined by 
the Panel during upcoming reviews. Lightning protection for the 
Shuttle as a system is discussed in more detail in Section h of 
this report. 
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3.3 External Tank Project 


The F. xternal Tank la a part of the main propulsion ayatem, along 
with the main engines and interconnecting portions of the Orb Iter 
vehicle . 

In this section the discussion will be devoted expressly to the 
external tank and peripherally to those significant interfaces with 
the Orbiter and Solid Rocket Booster that affect crew safety. 

The External Tank is the only element of the Shuttle system 
chat Is discarded after depletion of its oxidizer and fuel resources. 
Because It is expendable, great emphasis has been placed on low cost 
production of this tank. The external tank Is being designed, developed 
and manufactured by the Martin Marietta Corporation at the Government- 
owned Michoud Assembly Facility in ljouisiana. 

The External Tank consists ol three major components: (1) a 

liquid oxygen tank, (2) an irter-tank, and (3) a liquid hydrogen tank. 

It is of aluminum construction utilizing a spray-ou loam insulation 
and spray-on ablator tor thermal protection. A configuration is 
shown in Figure 25 . In September 1974 a Preliminary Design Review 
of the tank was conducted; the Critical Design Review is scheduled 
tor the fall ol L975. Fabrication and assembly of the LOX and liquid 
hydrogen tanks for the structural test article will begin in the 
sunincr ot 1975. 

3.3.1 Subsystems Critical to Crew Safety 
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The rank can be divided Into the following subsystems: 

(a) Structures 

(b) Propulsion and mechanical 

(c) Electrical 

(d) Separation and dispersion 

(e) Thermal Protection Subsystem 

(f) Ground support equipment and logistics 

Particular attention was given by the Panel to those components 
or situations most critical to crew safety. These were chosen on 
the basis of the criteria used on other elements of the program - 
potential problems utilizing experience on prior programs and com- 
ponents that could critically degrade the per formrnce of the Orbiter 
or SRB if they were improperly designed, could not be tested or ana- 
lyzed to the degree necessary for confidence in them, or tailed to 
operate during critical mission sequences. To illustrate, the Panel 
in its review of structures gave particular attention to fracture con- 
trol. A review of the propulsion system focused on the ant i-geysering 
system. Review of the electrical system focused on controlled use of 
teflon wiring as well as on lightning protection. 

Weight control is as important a management concern on the 
External Tank as on the other elements of the Shuttle program. The 
next control weight has been set at 7L’,.lbO pounds. With a current 
estimated weight of 71,443 pounds, the margin is 915 pounds. There- 
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lore, the Panel la sensitive ;o the Impact of weight control u„ 
decisions affecting crew safety. 

1.3.1. 1. Structurea 
System Design 

The structure must retain the liquid oxygen and hydrogen within 
their respective tanks and must serve as Lite structural backbone ol' 
the launch and ascent Shuttle vehicle as well. Material provided to 
the Panel indicates that the design and construction of the structural 
portions of the External Tank follow the large Saturn tank and Titan 
tank methods, as well as the use of current sophisticated design tools 
developed by NASA (NASTRAN). 

In light of prior program experience, the Panel reviewed the 
actions taken by NASA and contractor management to insure that the 
initiation or propogntion ol cracks or cracklike defects in the 
External Tank will not cause structural failures or unacceptable 
leaks . 

Current Status 

Fracture control plans have been developed to cover the phases 
of design, fabrication, test, environmental control, inspection, 
maintenance, repair, and acceptance procedures. A Fracture Control 
Hoard has been established to assure the plans are implemented. fhe 
straight polarity TIC welding process has been selected. Vendors lor 
critical formed parts, such as gores and caps, have also been selected 



both NASA ami tht* contractor leal that (lie Initial processes provide 
a reaaonable basis lor confidence, 

Some fracture mechanic II mil a for l ank welds are shown L« 

Figure -f> . 

1.3. 1.2 Propulsion and Mechanical 
System IX* a inn 

The External Tank propuls lon/mechanical subsystem delivers LOX 
and liquid hydrogen to the Orbiter interface from the external rank 
age. The propulsion and mechanical subsystem is comprised of the liquid 
oxygen feed system, liquid hydrogen feed system, T.OX tank p. jssuri- 
zatior. and vent/relief system, intertank and tank environment control 
systems. The separation system, normally considereu a part ot the 
mechanical and/or structures' system, Is discussed under a separate 
section later in this report. There are three separate mechanisms 
associated with the External Tank propulsion subsystem: (1) intertank 

umbilical disconnect, (2) right ait ET/Orbiter umbilical 1.0X dis- 
connect, and (3) left aft F,T/OrbiLcr umbilical liquid hydrogen dis- 
connect. Only the Intertank disconnect is discussed in this section 
since the other two are a part of the in-flight separation system. 

One of the more significant design features of the external 
tank that should provide for greater hardware reliability and re- 
duced mission risk is a dual flange seal with the capability of 
monitoring leakage through the primary seal. this seal is used at 
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all major structural tank connect Iona . See Figure 27 . 

The LOX pressurize t Ion line is supported by 29 sliding supports 
and three fixed supports. These supports are bolted to floating 
anchor nuts in brackets welded to structure on the LOX tank. A 
phenolic insulation block is placed between the support and the tank 
to reduce heat transfer. These same supports also serve the larger 
anti-geyser line and the electrical tray. Seven flexible joints 
accommodate thermal and dynamic deflections. Figure 28 shows not 
only these lines but the LOX propellant feed-system as a whole. 

The vent/relief assembly serves two functions: (1) tank vent- 

ing during propellant loading, which controls the boil-off rate, 
and (2) relief of the ullage pressure to protect the tank structure 
in the event that it exceeds a preset value. 

The liquid hydrogen feed system is similar to the LOX system. 
The liquid hydrogen pressurization line assembly provides the means 
for transmitting adequate pressure and for the correct rate of flow 
ol LH^ to ihe Orb iter main engines. The LH-, recirculation line is 
a 4-inch vacuum- jacketed line which provides a return path for the 
hydrogen recirculation flow that used to thermally precondition the 
SSMF prior to initiation of engine start. The vent /re lief assembly 
serves the same two functions as the similar system in the LOX feed 
system. 
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The l Jink environment al control or cond 1 1 ionium system includes 
I, OX, liquid hydropen and inter-tank purpo hardware. I’rope l lant tank 
purpo is accomplished prior to propellant loading,, ’flu* inter-tank 
purpo uses dry pa so on a nltropen to remove rout ami nan t s trom Its 
area and to maintain the temperature of the inter-tank arett at HO t IS 
deproos K. 

Kxternal t ank-to-pround Interlace eonslsts ot an envi .ronment al 
control system disconnect, a pa aeons hydropen vent line disconnect , 
and t.OX and liquid hvdropen vent valve pneumatic control line dis- 
connects. See I'ipure . 

The Panel pave particular attention to the control ot the possible 
hazard ot pevserinp. Oeyserinp Is the rapid upwolliup ot I .OX into 
the tank ullape area; this can cause a rapid reduction ot t He ullape 
temperature, reduce the ullape pressure and, in the worst case, re- 
sult in the eol lapse* ot (he 1.0X tank. litis phenomenon has been lound on 
prior larpe liquid roekels and oecurs when a comparatively hiph density 
ervopenie llutd contained itt a line or tank bepins to heat up and 
bubbles torm at a propress i ve 1 v increasinp rate. As a bubble matures 
it bepins to rise throuph the' liquid, due tv' its reduced density. 

At the same t tine the liquid head (pressure! on t he bubble is con- 
stantlv be l up reduced. As the bubble moves upward it accelerates 
and pushc liquid ahead v't it. When the bubble teaches the tank, the 
liquid above it is expelled upward throuph the liquid surface Intv' 


the open tank area with great force. It is not unusual for this slug 
of liquid to weigh several hundred pounds. Thus, in addition to the 
possible tank pressure reduction, resulting in conditions conducive to 
tank collapse, there is a danger of the slug itself hitting Internal 
structure and damaging the structure and any lines or instrumentation 
therein. The return of this liquid cun also result in "water hummer" 
effects. 

The geyser ing action is shown schematically in Figure 30 . 

Current Status 

NASA/MS FC and Martin Marietta Corporation have baselined what 
appears to be an acceptable ant i-geysering system and test program, 
all of which must be completed before the initiation of the main pro- 
pulsion test program at NST1.. To prevent geysering it is necessary 
to agitate the liquid column to prevent stratification or layering 
during the ground till sequence when lines and tank arc relatively 
warm. Current design plans are to use helium injection sysLcm as 
shown schematically in Figure U . Actual design of the system is 
still under study and analysis because the initial design concept as 
proposed was considered less than optimum. Location of the function 
of the 4-inch l.OX anti-geyser line with the 17-inch l.OX maln-leed- 
ltne can potentially cause unpredictable flow patients as well as 
nullify the desired el lecl ot the system. This could happen if there 
is a ground helium supply l allure lor any reason because the LOX vent 
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valves then would close and helium Injection lor ant l-geysoring pro- 
tection would be terminated, It is proposed that a proper degree ol 
redundancy be provided in the ground system to assure a tall sale 
arrangement, A lest plan approach has been developed to support the 
1.0X ant l-geyscring program. The test plan itself is still in work 
along with the type of hardware and lest facility to accomplish the 
objectives of the program. Test schedule is: 

Hardware on-site and installation start February 1, 197b 

Test start September 197b 

Test completion March 197/ 

Proposed tost configuration is shown in Figure , 
d . .1 . 1 . t Fleet rical Subsystem 
System IV* sign 

For the design development test and engineering phase of the Space 
Shuttle program, the external tank eleetrieal subsystem ineludes: 

(11 operational insl rumentat ion, (.’1 eleetrieal distribution, tM light 
nine, proleetion, and (/»> development t light instrumentation as 
appropriate . 

Operational Instrumentation ineludes those external tank imm- 
inent s required to monitor and eont rol tank-related lunet ions irom 
the start ot propellant loading through tank separation, t'ach instru- 
ment is supposed to be individual Iv hardwired through the tank elee- 
trieal distribution cable assemblies to the IT/Orblter umbilical 
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connectors. Amperage Umltlng '* ' ,r0 '’ ld "‘ l by Lh ' ° rtl “ r 

Cor M circuits penetrating tho B tsnK. t. P»«U- «•» 
ot ignition sources. Since this Instrumentation consist, only ot 
sensors andcnbltng from the. to the Interlace, no circuit ground. sre 
„de to the tank structure. All sensor lends are Individually re- 
turned to the Orbitcr Cor single point grounding. Cable shields are, 
however, funded to tank structure to satisfy electromagnetic 
patiblllty requirement s . 

Development flight Instrumentation Is, by definition, non-crltlcal 
C„r external tank operation and will be installed on the main pro- 
pulsion test article at NST1. and on the first six external tanks. the 
principal requirement from a safety standpoint is that this Instrumen- 
tatlon Shan not cause the failure of any critical external tank func- 
tion. The general design and construction of the development instru- 
mentat Ion is the same as previously described for the operational in- 
strumentation. Electrical power for the Instrumentation assemblies is 
supplied through the Orbitcr umbilical interface, there are two opor- 

at ional Ins.rumeo.a.ton cable harnesses inside f. U* «-■ M»- 

• t. til. in fKKP' Insuluteii wire, und 
gen tanks. The cables are "tide ot tollon (111. 

the sensors are attached with ilxed apH.es, insulated and sealed with 
heat -shrinkable TEE tetlon tubing and meltable EEP tetlon. Each cable 
1. routed through a separate cryogenic feed-through connector mounted 
the noseplate o, the MS tank and the torward dome o, the li,uid 
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hydrogen tank. The wire bundles inside the tanks are spot tied with 
lacing tape and supported by corrosion resistant steel bands with 
teflon cushions. The use of teflon (FEP) insulated wire in contact 
with hOX has been identified as a potential hazard since it includes 
both a fuel (teflon) and a potential ignition source (electrical 
energy) interfacing with LOX. 

The philosophy expressed in NASA's NHB 8060. 1A, "Mammabili ty , 

Odor, and Offgassing Requirements and Test Procedures for Materials 
in Environments That Support Combustion," is that the design of LOX 
systems should preclude any ignition sources interfacing with the 
media. If this goal cannot be met, any material used in the proximity 
of a source of electrical energy shell be evaluated in the proposed 
configuration. Evaluation should be made using the worst-case elec- 
trical and environmental conditions and by applying the techniques of 
NHB 8060. 1A, Test No. 4, "Electrical Wire Insulation and Accessory 
Flammability Test." Results of the Apollo U incident and subsequent 
testing have shown that teflon will not pass such a test in a cryogenic 
high pressure oxygen environment. See Figure ^ . MS 1C has stated 
that Saturn Launch Vch'.cle test experience with teflon (TKE) coated 
wire shows that: (1) teflon coated wire insulation cannot be ignited 

under 1 XIX by any electrical over-load, (2) tel Ion coaled wire insu- 
lation can be ignited in gaseous oxygon by approximately 800.'. elec- 
trical overload and will propagate, *nd (.!) in the unlikely event of 
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ignition under oper*,.! '•nnl conditions, fire will not propagate through 
the feed- through-connector at the tank wall. Shuttle sensors are 
similar to those used on the Saturn second stage, S-II. Analysis 
and testing (similar to that which will be accomplished for Shuttle) 
were conducted subsequent to the Apollo 13 incident for the S-II sen- 
sors and demonstrated that no safety problem existed. It was stated 
that the temperature on the cable will be sufficiently below the sub- 
limation point of teflon to maintain a safe condition in the cabling. 
The Panel pointed out that while the size of the wires was small and 
the potential of applying in excess of the 800% overload appeared 
minimal there still could be some chance of a problem, and suggested 
further consideration. 

Current Status 

MSFC will conduct worst-case current overload testing and analysis 
in the LOX environment using actual ET hardware and all circuit pro- 
tection devices (in their worst-case credible consequences of their 
failures). Testing would include sensor shorts, opens, normal oper- 
ation and electronic failure modes. This issue will be considered 
resolved it the above testing is successful. it was also suggested 
by the Panel that all other similar non-metallic materials' appli- 
cations be reviewed and appropriate disposition made. 

The External Tank design incorporates leaturos to protect the 
structure and subsystems from the direct and indirect effects ot 
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triggered atmospheric discharges during transportation, prelaunch, 
launch and ilight operations. Methods employed to provide lightning 
protection are intended to assu.e that low resistance paths are pro- 
vided on the External Tank surfaces to distribute lightning currents 
through the structure and to guide currents around or over nonmetallic 
areas. At this time lightning protection on the nose cap consists of 
a short nose rod and conductive aluminium strips cemented onto the 
vehicle and electrically bonded to the structure. The LOX hydrogen and 
inter- tanks incorporate thin aluminum strips, adhesive -bonded to the 
external insulation surface and electrically bonded to the LOX tank 
skin. Further protection measures include the use of twisted wires 
on all internal circuits and twisted shielded cables in exterior 
cable tunnels. 

The only significant problem noted by MSF. was the possibility 
that the diverter strips could debomi or melt in flight and the re- 
sultant debris could possibly damage the Orbitor in some manner. 


11,18 problom is currently under study to determine alternate designs 
and to further understand the impact of strips melting or debonding. 

J . 3 . 1 . 4 Separation and bisposition 

The External Tank interfaces with the Orbitor and the Solid 
Rocket Boosters. In the mission events time -line, the Solid Rocket 

* r " a, 'P i,riUod ««• ‘he External Tank/Orblter combi,, at ion and 
then the External Tank i 


s separated from the Orbitor. The ET/SRH 


attuch configuration is shown in Figure 34 t and the aft and forward 
attach configurations between the External Tank and the Orbiter are 
shown in Figures 35 and 36 . The separation hardware in both the 

Orbiter and Solid Rocket Booster case are designed by their respective 
contractors (Rockwell International and Thiokol) and not by the tank 
contractor since the External Tank portions of separation interfaces 
are passive. Martin-Marietta Corporation does support the Rockwell 
International and MSFC (SRB) efforts in defining, designing and test- 
ing the separation hardware. Aspects of the ET/Orbiter separation 
have been discussed under the Orbiter Section 3.1 and the same will 
apply to the Solid Rocket Booster Section 3.4. Only those Orbiter 
and SRB actions that can affect the External Tank's ability to sep- 
arate safely and be disposed of during its return to earth are dis- 
cussed here. 

The Solid Rocket Booster (SRB) separation from the External Tank 
(ET) follows this sequence: (1) Orbiter receives separation cue from 

the Solid Rocket Booster, (2) Orbiter arms’ separation system pyro- 
technic initiator controllers on both of the SRB's 0.8 seconds after 
the Orbiter cue is given, (3) Orbiter issues fire coranands to 

separation system "A" on both SRB's simultaneously 2.5 seconds after 
the Orbiter cue, and (4) Orbiter Issues fire contnands to separation 
system "B" on both SRB's simultaneously 40 milliseconds after the 
system "A" fire eonmands. 
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Actions to be taken if Tor some reason this 


separation dues not 


take place are to be examined further by the Panel, All the prime 
contractors and the NASA Centers are involved since this is an inter- 
face problem. 

The External Tank separation from the Orbitor follows this 
sequence: (1) forward Orbiter reaction control system deployment, 

(2) fluid and electrical umbilical separation, (3) forward and aft 
structural attachment release, and (A) Orbiter maneuver away from the 
External Tank. Sequencing of ail separation operations commands 

are initiated and controlled by the Orbiter. As a result of new 
loads analyses for the ascent portion of the mission, the External 
Tank/Orbiter aft attach loads have increased, requiring hardware modi 
locations which do not appear to unduly affect the separation events 


mentioned above. There are some safety concerns that result from the 
jparation process which have been discussed with the Panel: (1) b» 2 


se 


and LOX trapped between the feed-line closure valves and released as the 
External Tank and Orbiter separate pose a potential Lire/explosion hazard 
and, (2) External Tank recontact with the Orbiter vehicle primarily 


due to Orbiter hardware problems. 


External Tank entry and disposal 
been of great interest to the Panel, 
guidelines applicable to the External 
stated as: 


after release 
I'.round rules, 
Tank disposal 


from the Orbiter has 
constraints, and 
problem have been 
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(a) No External Tank Impact below 60° South parallel, baaed 
on State Department International agreement, 

(b) External Tank Impact locations shall be in ocean areas 
with minimum ship traffic densities. 

(c) External Tank Impact locations shall be no closer than 
200 nautical miles from land masses. 

(d) External Tank impact location and dispersions are pre- 
dictable. 

(e) External Tank rupture for nominal missions shall not 
occur above 240,000 feet altitude, 

(f) External tank distruct from any cause shall not occur 
within four (4) nautical miles of the Orbiter, 

On normal missions the External Tank separates from the Orbiter 
at almost orbital velocity. The impact site is therefore sensitive 
to variations in the Lank velocity and other conditions at separation. 
The question then is whether the selected design can ensure that the 
tank or the debris will always land in an acceptable ocean area. 

Aborts and catastrophic situations during launch and ascent also must 
be considered, and the added hazard of having large quantities of pro- 
pellant and oxidizer under such situations must be taken into account. 

A major consideration in the proper disposal of the tank is the 
point in the ascent at which lime the Orbiter main engines are cut- 
off. The definition of the MKCO (Main Engine Cut Off) is currently 
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baselined as occurring at an altitude ot 60 ml. for 1Mralnal mlaslon 
and at 55 n. ml. for an "abort-oncc-around" mission. na.od on thoan 
nltltudan, the MECO condition, for a launch fro,., KSC arc a. follows: 

(a) For a nominal mlaslon, the altitude of 60 n. ml. with a 

velocity of 25,383 feet per second and an »n„lo of attack of 0.5 do- 
grees. 

(b) For an abort mission (AOA) , with an altitude of 55 n. 

mi. with a velocity of 25,317 feet per second and an angle of attack 
of 0.75 degrees. 

(c) For the re turn- to- the -landing-site (RTLS ) abort mode, 

the MECO target is at 230 000 fp P k r\i a „ . . 

b ^ju,uuu teet (37.8 n. mi.) with a velocity on the 

order of 6,500 FPS. 

These MECO conditions for a launch from KSC are valid for a wide 
variety of launch inclination, and payload weights. Figure 37 1, 

typical of the tank disposal landing footprint for nominal and AOA 
conditions . 

There are two major challenges associated with the safe reentry 
of the External Tank. The fir t is the premature breakup due to 
L0X and hydrogen tank ruptures as well as determination of actual 
breakup altitude and uncertainty of the dispersion of the resultant 
debris. The second is the inability to assure tank impact predict- 
ability without the use of system that causes the tank to tumble. 

The tumbling condition must be achieved before the tank has 


any chance 


ol "skipping" due to aerodynamic lift, as well as having a tumble rate 
that prevents the occurrence of the "Irisbee" effect, which occurs at 
too high a tumble rate. Typical effects of three different nominal 
entry conditions are shown in Figure , These assume a tumble 
rate of 30 degrees per second maximum and - 1.3 degrees per second 
as minimums. The frisbcc effect shown In Figure 39 becomes notice- 
able at tumble rates in excess of 30 degrees per second. Prcmato.e 
tumbling might also result In contact of the External Tank and the 
Orbiter. As a result of current studies, the following two ground 
rules have been established tor an acceptable tumble system: (1) no 

tumble action to be initiated prior to bO seconds after separation 
from the Orbiter, and (2) acceptable tumble rates are h 'tween 10 and 50 
degrees per second. Me tin Marietta Corporation currently is conduct- 
ing studies to refine and define an "optimum" system to satisfy the 
ground rules noted above. The systems being considered are: 

(a) Blow down, using LOX vent valves 

(b) Solid rocket thrusters 

(c) 1.0X and hydrogen tank "blow holes." 

3. 3. 1.5 thermal Protection Subsystem 

In November 1974 the Thermal Protection Subsystem baseline was 
changed due to a significant increase in expecLud thermal heating 
environment and io a requirement to minimize ice formation and its 
impact on the Orbiter. Ihis new baseline data at fee ted the insulation 
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material used on the three major set l ions of the tank: LOX tank In- 

cluding the nose cone, the lnter-tank, and the hydrogen tank. 

Current design thermal Inputs to tin* External Tank segment s 
based on analyses through December 1974 are: 

(a) For the LOX tank f orward ogive section t he induced ther- 
mal environment can be as high as 10.5 btu/ft 2 -sec , but new hypersonic 
wind tunnel data indicates a value that could be as high as lb biu/tt 2 - 
sec. The LOX tank, inter-tank and hydrogen tank thus are considered 
to be subject to heating values in excess of chat normally acceptable 
for the proposed new insulation material (Upjohn CPR-421 spray-on foam 
insulation (SOFI). The CPR-421 is considered appropriate for heating 

values up to about b btu/it~-sec but are unacceptable at valued around 
2 

10-11 btu/ft -sec. The material used on structure subjected to very 
high heat rates is an ablator material called SLA-5bl with a silicone 
sealant coat. These areas include the Orbiter aft attach strut, tor- 
ward attach strut, liquid hydrogen feedline and crossbeam, and the LOX 
tank conduit. 

In addition to preventing ice formation and heat input to cryo 
fluids, one ot the major reasons for the insulation is to preclude the 
air liqui 1. ical ion because liquid air is bigh in oxygen content: when 
boiling off, and compatibility problems exist when it contacts hydro- 
carbon materials. 

NASA and the prime contractor arc currently conducting studies 
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aivl testa to establish an Insulation configuration that will satisfy 
known induced and natural environments with a capability for future 
possible heating rate increases. They feel that neither trajectory 
shaping or external tank configuration changes are practical methods 
of alleviating this problem. 


3. 3. 1.6 (1 round Support and Logistics 


The mode of transportation for the External Tanks to the launch 
site has been settled. Barges will be used in a manner similar to 
that for the Saturn launch vehicle stage movement (S-1C and the S-1I). 

The use of any carrier aircraft has been ruled out at this time because of 
the modifications required, cost and safety implications. 

To assure propellant and oxidizer cleanliness, the following re- 
quirements have been levied on the External Tank system: 

(a) The LOX and hydrogen tanks will be cleaned per MSEC - 
Spec - 164A, with no particle larger than 1000 microns. 

(b) At the exit of each tank, propellant screens will be 
installed. For the hydrogen tank this will be a 400 micron glass 
bead rated" screen, and for the LOX tank an 800 micron "glass bead 
rated" screen. 

(c ) All lines and components downstream of the filters 
shall be cleaned to a maximum particle size of 400 microns for the 
liquid hydrogen and 800 microns for the LOX. 

It was noted that the External Tank design common fill and de« 


L2 


livery lines insure that any contamination introduced into the ayatem 
during propellant loading will be delivered to the main engines. There- 
fore, the ground systems ami the Orhiter line a have to be cleaned to 
at least the aame levels as the External Tank lines which interlace 
with the Orbiter. 
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3.4 Solid Rocket Booster 


Prior to liftoff the Orbiter Main Engine* are Ignited and 
brought to full thrust and both Solid Rocket Motors are armed 
and ignited from simultaneous ignition commands. A.t approxi- 
mately 150,000 foot altitude, the thrust of both Solid Rocket 
Motors will have decayed to less than 257, of nominal. At this 
time separation of both Solid Rocket Boosters is initiated and 
the Orbiter and External Tank continue toward orbit. Upon 
successful separation of the Solid Rocket Boosters, a sequence 
is initiated for individual recovery of the two booster units. 
Parachutes are deployed along the trajectory of each unit to 
provide for soft impact within a predefined recovery zone. Each 
booster is to be floated by entrapped air until the arrival of a 
recovery ship ov ships. The flight time, launch to splashdown, takes 
about 7 minutes and 15 seconds. 

The Solid Rocket Booster element of the Space Shuttle system 
is made up of seven subsystems: (1) the solid rocket motor, (2) the 
thrust vector controls, (3) separation subsystem containing 
mechanical and ordnance equipment, (4) the recovery subsystem 
containing mechanical and parachute equipment, (5) avionics, 

(6) structure, and (8) a destruct or range safety subsystem. 

The Thiokol Corporation in Wasatch, Utah was selected as the 
Solid Rocket Motor contractor. T hey have completed the design of 
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most of the tooling for the fabrication of the motor cases and 
procurement is underway. The contracture 1 awards for the 
structures, separation motors, recovery system, thrust vector 
control, and avionics had not been completed at the time of the 
Panel's review. However, since the Solid Rocket Booster Pre- 
liminary Design Review was completed in November 1974, the Panel 
was able to review the detailed design of the booster components. 
As mentioned in an earlier section on management, the overall 
integration of the booster is being performed by the Marshall 
Space Flight Center in Alabama. NASA plans to select a booster 
assembly contractor in fiscal year 1977. 

3 . 4 . 1 Solid Rocket Motor 
System Design 

The solid rocket motor includes the case, propellant, igniter 
and nozzle as shown in Figure 40. Flexibility in fabrication and 
ease of transportation and handling are made possible by a 
segmented case design. The propellant grain is shaped to reduce 
thrust approximately one- third some 5 5 seconds after liftoff to 
prevent overstressing the vehicle during the period of maximum 
dynamic pressure. The grain is of conventional design, with a 
star-shaped perforation in the forward casting segment and a 
truncated cone perforation in each of the segments and the aft 
closure. The contoured nozzle expansion ratio is 7.1(>:1, The 
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rocket motor case la made up of ten separate segments with specific 
joints to meet the structural requirements and weight needs as 
shown in Figure 41. The following la a performance sundry of 


the rocket motors under nominal conditions at 60 F. ^ 

(a) Vacuum delivered impulse, lb-sec 290.6 x 10 (T 1 sec.) 

122 

(w) Burn Time, seconds 

(c) Propellant burning rata, In/aec 0.411 (at 1000 pal) 

(d) Specific Impulse, average, lb-sec 262.2 X 10 

The Solid Rocket Motor Ignition hardware consists of an Igniter and 
dual redundant standard man-rated Initiators. These Initiators are 
separated by «n Independent electrically dual redundant (2 motors 
and 1 shaft) electro-mechanical safe and arm device. Each initiator 
1. fired by an Independent Pyrotechnic Initiator Controller (PIC) 
upon command. The safe and arm device is maintained In the safe 


position by a mechanical safety pin until a given point in 
countdown at which time it is removed. The device remain, in the 
safe position until the arm-command is Riven Immediately prior to 

the motor ignition. 

The items associated with weight and weight control are: 


(a) Motor Mass Fraction 

(b) Total Solid Rocket Motor, lbs. 

(c) Solid Rocket Motor, lbs. 


0.884 

1,254,210 

1,227,250 
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Currant Status 


There have been studies on alternate propellants to minimize 
HC1 release above 65,000 feet (ozone layer) during the ascent 
portion of the mission. To date the studies indicate that it 
is technically feasible to minimize (less than 3% by weight) or 
eliminate the release of HCl above 65,000 feet. However, tuere 
would be a probably payload loss of 2,000 to 7,000 pounds. These 
studies will continue as one of NASA's efforts to reduce the 
atmospheric impact from the Space Shuttle operations. 

NASA has noted that the Solid Rocket Motor and booster 
components fabrication requirements are considered to be the 
current state-of-the-art technology which has been demonstrated 
in systems such as the Titan III rocket now in use. 

Thrust mismatch of the two rocket motors is of great concern 
to the designers and the operation of the Shuttle system. As a 
result of this concern, NASA and its contractors, continue to pay 
a great deal of attention to having both the rocket motors ignite 
and essentially tail-off simultaneously and an acceptable thrust 
mismatch during normal ascent. The reproducibility limits, based 
on the latest analysis, are shown in Figure ■'•.!. Thus there will most 
likely be a need to match pairs of rockets. The specification 
requires that there not he a mismatch greater than 710,000 pounds 
during the tail -of; thrust period at around 115 seconds after 


ignition. 



The POGO phenomenon la not expected to manifest Itself in the 
burning characteristics of the rocket motor. However, the potential 
for this motor to contribute to POGO will be explored fully by the 
program offices as a part of the overall POGO effort. 

3.4.2 Thrust Vector Control 
System Design 

The Thrust Vector Control subsystem controls the angle of the 
noEzle of the rocket motor, in order to obtain the proper flight 
trajectory. Each Solid Rocket Booster contains a Thrust Vector 
Controx assembly consisting of redundant hydraulic power units and 
two actuators. If one of the hydraulic power units fails, a valve 
in the actuators isolates the failed unit and this prevents any 
loss of thrust vector capability. The servovalves for each actuator 
are hardwired across the SRB/ET interface and accept steering 
commands from the Orbiter guidance and control system to provide 
motor deflection. The basic requirements for this control system are: 


(a) 

Torque, inch-pounds 

4,200,000 

(b) 

Rate, degrees per second 

5 

(c) 

9 

Acceleration, radians per sec" 

2 

<d) 

Gimbal Angle, degrees 

5 

(a) 

Redundancy 

Fail safe as minimum. 


Current Status 

The current design is a fail operational/fail safe design. The Thrust 
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vector Control has . maximum glmbal cspabillCy of degreej ^ 

provides torque, in excess of those required for known io.di„ g e. 
Since the loads effort is a continuing activity the load, may 

change upward but appear not to be a MJOr problem at this time. 
3,4,3 Separatio n Subsystem 
System Dea-l ^ n 

The solid Rocket Booster separation subsystem consists of the 
forward and aft separation motor assemblies, the forward attachment 
unit and the aft attaint and umbilical pull-aw.y unlt , Flgure 43 . 
The separation sequence for the booster is: 

(a) Orbiter receives separation cue from both boosters, 

(b) Orbiter arms two sepration system pyrotechnic 
initiator control, on both the A and B units in both boosters 0.8 
seconds after the cue is given t0 the orbiter, 

(O The Orbiter issues fire commands simultaneously to 
the "A" unit on both the boosters at 2.5 seconds after the cue, 

(D Orbiter issues the fire command simultaneously to 

UnIt 3 * Paratl °" aSSe " bUeS ^ boosters .* 40 milliseconds 
utter system "A" has been given the fire comnand. 

The cue received by the Orbiter is in the form of a pressure signal 

-hen the Solid Rocket Motor chamber pressure has reached 50 ti 5 psla 

on any two pressure sensors used for this purpose. The separation 
system avionics is shown in Figure 44. 
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Current Status 

The forward and aft separation motor asaeblles each consist of 
four separation motors and Ignition ordnance which are fired to 
impart side thrust to the expended booster. There has been a 
recent change in the motors to reduce, if not eliminate, the 
Impingement of the motor plumes on the Orbiter Thermal Protection 


Subsystem. These changes are noted here: 



Before 

Current 

Thrust Level, lbs. 

12,000 

20,000 

Burn Time, seconds 

2 

0.75 

Propellant Restrictions 

none 

max. metal or stabilizing 

additives - 27. 

burn rate additives - 17. 

Igniter Case Material 

glass phenolic 

non-debris generating 

Igniter Propellant 

no restriction 

same restrictions as main 
propellant 

Thrust Tail-Off Rate 

no restriction 

Tail-off to 507. chamber 
pressure limited to 
100 milliseconds 

Motor Location 

SRB forward back 
of frustum and 
aft skirt 

Nose frustum and aft skirt 

The forward attachment 

unit consists of 

an SRB fitting, called a 


thrust post, supported by the SRB forward attachment structure which 
mates with an External Tank fitting. This forward attachment pro- 
vides longitudinal SRB/ET restraint and transmits thrust from the 
SRB to the ET /Orbiter. The SRB and ET mating surfaces are held 
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together by a double-ended separation bolt which is internally 
redundant for the separation function. A standard manned spacecraft 
initiator pressure cartridge is mounted on both ends of the double- 
ended separation bolt. At separation, both of the separation 
cartridges are fired and the resultant pressure buildup drives an 
internal piston at each end of the separation bolt toward the 
separation plane to effect bolt fracture. Operation of either piston 
will fractur. the bolt. 

The aft SRB/ET attachments include a lower, upper, and diagonal 
strut assembly which provide lateral and rotational restraint 
between the SRB/ET. Each strut assembly consists of a SRB and ET 
fitting held together by a double ended separation bolt similar in 
design and operation to the forward attachment separation bolt. The 
"pull-away” connectors used at each SRB/ET interface carry the 
electrical circuits as follows: 

(a) Forward Attachment 1 

(b) Aft Strut (Diagonal) 1 

(c) M't Strut (lipper) 5 

(d) Aft Strut (Lower) 3 

As a result of the latest Shuttle system loads analysis, December 
1974, there is an effort underway to redesign the forward thrust f lutings 
and aft attachment struts. This will result, moat likely, in some 
weight increases. There is no expected change lo the basic concept 
of the separation assembly described here. 
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3.4.4 Recovery Subaystein 
System Design 


The booster recovery subsystem provides the necessary hardware 
to control the descent (velocity and attitude) after separation from 
the External Tank. The recovery subsystem Includes those Items 
used to separate, deploy, disconnect, control attitude, float, and 
provide for location of the expended booster. Figure 45 shows the 
booster recovery (separation to splashdown) events and associated 
parameters of performance at each stage. The booster recovery main 


chutes, drogue and frustum, and booster Itself are buoyant. The 
recovery system Is redundant except for the beacon and flashing light. 

Briefly the sequence of events Is as follows. A conmand Is 
sent from the Orblter to the Solid Rocket Booster Just before 
separation to apply battery power to the recovery logic network and 
at the same time to arm the nose cap thruster for deploying the drogue, 
the frustum ring detonator for main deploy, and the main chutes 
disconnect. Two barometric switches are sot to close at high altitude 
(below 19,000 feet) and at low altitude (below 10,000 feet). At high 
altitude the nose, cap thruster fires, pushes the nose cap away from 
the booster, and deploys the drogue chutes. At low altitude the 
frustum ring detonator fires, the drogue chute pulls the frustum away 
from the booster, and deploys the main chutes. After a time delay 
the no axle extension Is Jettisoned and the Impact switches are armed, 
g third barometric switch will close at a very low altitude to turn 
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on tlu 1 impact recorder Just prior to water impact. Ac impact too 
Impact switches close and after a time delay the main chutes are 
disconnected and the beacon and light are turned on. The nose 
section of the booster, containing the majority of the recovery 
hardware, is shown in Figure 46. 

The maximum vertical velocity for the booster ut water impact 
has been set at 100 feet per second. 

Current Status 

The Panel's major interest was directed toward questions 
concerning the inherent safety of a reusable Solid Rocket Booster. 

The solid rocket case, the parachutes and the hardware for the 
separation of the booster from External Tank were of the greatest 
interest. In this section the parachutes and separation hardware 
arc discussed, while the motor case is discussed under the "Structures" 
paragraph which follows. The separation hardware includes the 
forward and after separation motet* assemblies, forward and aft strut 
attachment units and the umbilical pull-away connector units. The 
separation motors are burned out after use and require replacement, 
as does the ignition ordnance. As noted in the reviews conducted 
at MSKC the electrical connectors and wiring are the major items 
requiring retest and rehabilitation for reuse in the booster. The 
attachment struts and fittings are a part of the u true turn and are 
covered in th®t: seet ion. The replacement of used pyrotechnic 
cartridges and retest of the connectors and wiring is the. important task. 
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. Wr ogue ana main) Is new to NASA 

ReCurblshnwnc oC - — ^ „„„ 8pMC re- 
4 t-httt NASA’s current approach Is to n 
experience a at deal ol IK® experience 

. However, there is a b rc 

covery parachu . aircraft braking 

, , 0 reusing parachutes, c.g., atrcraic 
available with regard to reusing P 

. fea aiu i personnel parachutes, 
chutes, cargo parachutes 

, . i„ Table X Is indicative of the approach used 
The material In specifically , 

n drogue or main chute. More sped t 

defining the ability to reu materials such as 

have been developed for commonly used tna 
the following data have 

only 10 hours ol exposure at 150 1- ^ 

(O Since these nslterlals are hyproseoplc (« 

th lo ss when subjected to high humidity, 
i „„i v a slight strength loss wn 

they show only a an* 1 and 

(d) Radiation other than ultraviolet ts y 

chutes require shielding _, tl aUy allect the 

ornHitions do not appc.n 

( 0 ) Vacuum conoitum 

cute properties. 

3.4.5. Avionics. 

*>" m " **» i8ta ol the (oUowtuy. assemblies: elec- 

Ihe Kooster Avionics consists 

„„ io „ control rate tyro, recovery, run® sate y, 
t r leal , ins t tume u i a t ion , 
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awl failure detection, 

A Hlgnlflcant portion of fbe electrical and ln<u rum, -mat ton 

aro Included In rwo line replaceable unlta, flu- forward and 
nfl integrated olectronlca M«d>U«. noth contain the logic and 
networks dlotributlor, multiplexer-demultiplexer, signal conditioner 

and the forward two data buss couplers. 

The electrical system consists of a 28 VIK battery supplying power 
Cor separation, deployment and recovery functions through the logic and 
network distributors. These distributors, one forward and one aft, 
also provide the 28 vdc power from the Orbiter to signs, conditioners 
and associated measuring devices during the ground and flight period when 
the boosters still arc a part of the total Space Shuttle vehicle. 

The avionics associated with the recovery activities consists 01 
the following components: (1) Altitude /impact switch assembly, (2) 

X-band radar transponder (beacon system), (3) X-band radar antenna 0»a- 

con system), and (4) two flashing lights. 

Range safety subsystem, which is not yet de Lined, is to provide 

the destruct capability for the boosters in case ol early termination 
of the flight, litis system has been defined in the Level 11 Space 
Shuttle Program Flight and Ground System Specification", JSC-07700 
Vol. X, updated to May 1975, as "an add-on destruct system — which 
does not require any action by the crew prior to initiation ol. an 
abort. The svsletn function shall be dependent on real-time range 
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safety down- linked parameters end/or tracking data for the period 
after liftoff up to SRB/ET separation." 

Current Status 

Based on the material provided to the Panel, the following is the 
status of the range safety system: 

The design concept and selection of system components are 
complete except for conical shaped charge to be placed in the solid 
rocket booster element. Currently the program is involved in an 
effort to fully integrate the system design from the standpoint of ground- 
to- flight vehicle and between the flight vehicle elements. Acceptance 
of basic design concept by the Air Force Eastern Test Range is still 
under discussion. Working interfaces have been established between 
all organizations affected by the range safety system design, develop- 
ment and utilization. Discussions between these groups, reviews and 
planning sessions are being established. 

The failure detection setup for the booster provides the failure 
detection capability during boost phase of the flight. This setup 
had not been defined sufficiently for presentation to the Panel dur- 
ing its early Spring review at MSFC. 

3.4.6 Structures and Reusability 

The reusability aspects of the Solid Rocket Booster are so closely 
tied to the structural design capabilities that these two aspects of ^he 
booster program are discussed together in this report. Basically 
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Che only non-structural hardware built lor reuse are the electrical 
and instrumentation equipment, thrust vector control assembly and 
such recovery items ns the parachutes. The Solid RoekoL Motor case 
and attendant structure are all considered as a part of the structural 
asscmbl ■/. 

The current baseline for reuse of the Booster components is; 


Structures reuse 40 times 

Solid Rocket Motor Case and Nozzle 20 times 

Thrust Vector Control assembly 20 times 

Kleelrieal and Instrumentation reuses 20 times 

Recovery assemblies 10 times 

Batteries 1 time 


Structural design features to support the booster reusability 
program include such things as: (1) external protective coatings, 

(.’) weld-tree solid rocket motor ease, ( H water-tight compartment s 
using welded aluminum skins, (4) bulkheads lor protection ol the 
avionics (electrical and instrumentation items in the lorward portion 
ot the booster, ('0 st it toning lings along the all quarter ol the 
booster structure to help take the water impact loads, and (<>) the 
use ol a smooth sue lace lor the application ol thermal protection 
material around the ait skirl which covers the nozzle. Ihe Solid 
Rocket Mw or case is designed with H.00‘) metal thickness beyond that 
required tor t light loads, tractmo mechanics and water impact. 
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To 


allow lor wear due to "grit" cleaning during refurbishment for 
additional refilling*. The Solid Rocket Motor case Jointa are de- 
scribed in Figure 41. 

Current Statue 

An integral part ol the structural design procedure includes a 
"Fracture Control Plan" lor the Solid Rocket Booster and motor. Uiis 
plun establishes the requirements tor reporting, non-destructive 
testing (inspection), failure documental ion, traceability, service life 
recording, proof testing, and environmental control of all portions ol 
the structures defined as susceptible to structural failure due to 
flaws and cracks. In line with this plan, materials are selected and 
characterized tor specific Solid Rocket Booster and motor environments 
and fabrication processes and refurbishment requirements. One of the 
problems in designing the booster/motor structures is to account for 
fracture under other than plane-strain conditions and to provide a 
practical means for predicting ltle under the complex time-stress 
histories occurring during pad operations, boost phase ol the mission 
and recovery ol the booster. 

Other questions open at the time' ot the Panel's review deal 
mainly with the structural aspects ot the booster element. 

The spec Hied reuse requirements and the designs to meet them 
are dependent upon the det lull ions ol service life, satety laclors and 
their derivation. Some thoughts relative to reuse wit i eh are pertinent 
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to assuring a safe and coat effective booster are: (1) what will wear 

out or be rendered unserviceable after t.te specified number of reu.es 
that will not wear out or be unserviceable after a greater or lesser 
number of reuses or cycles, and (2) what would be designed differently 
if the design were required to be made to meet a higher number of 


reuses. 


Noise (vibroacoustic effects) generated by the Solid Rocket Motors 
and the Main Engines on the pad and soon after liftoff may impose severe 
requirements. The determination of these effects and the design con- 
straints are still under study. 

The booster design and expected attrition rates are highly de- 
pendent upon the extent of damage due to water impact loads. These 
stresses are dependent upon booster velocity, angle of impact, tem- 
perature of the structural material and surface conditions such as winds 
and sea state. Computer analysis programs have been developed to an- 
alyse (1) initial impact, (2) cavity forma Li on and collapse of the 
water volume, (i) maximum booster peueLration into the wutcr and at 
the same Lime water penetration into the throaL oi the rocket motor, 
and (4) rebound and slapdown on the water surtace. 

i'here are also those events associated with the time when the 
booster is in Hie water and the ships and men begin to retrieve the 
boosters trom the water. the degree that these operations impact the 
design oi Hie booster has not been lully explored by the Panel at 


this time. 


From the time a solid propellant rocket grain is cast until it 
has burned away in the performance of its mission, it is subjected 
to an array of stress- inducing environments including gravity, pro- 
pellant curing loads, handling shocks and vibrations, and the pressur- 
izations and accelerations that accompany ignition, launch, and flight. 
The possibility of safety related problems resulting from any one or 
combination of these environments will be examined in later reviews 
by the Panel. 

Lightning protection requirements for the Solid Rocket Booster 
are similar to those for the Orbiter. Equipment requiring protection 
include pyrotechnics, thrust vector conr.rol sensors and switching 
circuits, all exposed electrical cables, and the integrated electronic 
assembly (data buss couplers, signal conditioner, multiplexer-deplexer, 
logic and network distributor. 

Current lightning protection design measures include the follow 
ing: (i) single point ground on power circuits, (2) use of twisted 

wire pairs, (3) delays of 2-1 millisecond in the many switching 
functions, and (4) use of metallic cable tunnel to protect cable runs 
forward and aft and the use of multi-grounded overall shields on all 
ordnance cabling. 

Electrical interfaces between the Orbiter, External Tank, and 
the Solid Rocket Booster do not tully satisfy the lightning design 
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criteria. Interface design is being studied at this time to obtain 
a reasonable solution to this problem. On the SRB program several 
tests are being planned to validate the lightning protection arrange- 
ment: (1) cable core test on SRB equipment as required, (2) full 

scale lightning test on the External Tank/Booster attach struts with 
ordnance installed, and (3) cable tunnel attenuation tests. 
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3-5 Launch and Landing Element 


The launch and landing aspects of the Shuttle program are con- 
sidered an element in the same manner as the Orbiter element, External 
Tank element, SSME element and the Solid Rocket Booster element. The 
Launch and Landing element is under the jurisdiction of NASA's 
Kennedy Space Center. There are other prime and secondary sites, 
but the discussion here centers on the requirements, design, develop- 
ment, validation, launch, and landing preparation plans at KSC. 

The design and operation of the launch/ landing site is as much 
a key to achieving a low cost Shuttle system with rapid turnaround 
after a flight as any other element of the program. KSC's past roles 
on the manned and unmanned programs, in which facilities and know-how 
have been developed for the receipt inspection assembly, checkout and 
launch, plays a large part in their ability to meet their current and 
projected role in the Space Shuttle program. More specifically the 
Launch and Landing Project conducted at KSC covers the following 
activities : 

(a) Shuttle vehicle element receiving (including all that 
goes with such activities, e.g., inspections), assembly of the Shuttle 
vehicle including buildup from the elements to the total ready-to-fly 
vehicle, checkout and launch, 

(b) Recovery /retrieval operations for the Orbiter and Solid 
Rocket Booster. 
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(c) Ground Operation caking into account the necessary 
sustaining engineering, logistics, maintainability and the turnaround 
operations. 

(d) Facilities and Ground Support Equipment, such as Che 
Runway, Orbiter Processing Facility, Launch Control Center, Flight 
Test Control. A major innovation will be the Launch Processing 
System to satisfy the requirements for an automated launch checkout. 

With regard to payloads, KSC will prepare and install the 
Spacelab delivered by the European consortium, the automated payloads, 
the Air Force Interim Upper Stage Vehicle and the TUG vehicle and all 
other payloads. 

The KSC interface with the NASA Flight Research Center at 
Edwards, California, includes a major role in the Approach and Landing 
Test program. 

At Vandenberg Air Force Base, California, KSC will assist the 
Air Force in planning and will provide expert help in the area of 
turnaround operations, facilities, launch support equipment and pay- 
loads operations. 

Recognizing that the Panel has not had the opportunity to examine 
the Shuttle program from the KSC viewpoint in any detail, the focus 
was on a small number of areas of particular interest to the Panel 
at this time: Solid Rocket Booster retrieval, landing facilities and 
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landing controls, Orblter Thermal Protection Subsystems maintenance, 
turnaround operations, and launch Processing Subsystem. The Panel 
did, however, receive an orientation brletlng on the total KSC role, 
responsibilities and plans to carry them oat. 

3 . 5,1 Solid Rocket Booste r Retrieval 

Systems Design 

So we teve noted, the Marshall Space Flight Center has 
responsibility lor the development of the Solid Rocket Booster, 
Including the intact reentry of the booster Into the ocean. KSC, 
however, Is responsible for developing the retrieval system for 
returning the boosters to dry land for refurbishment and preparation 

for reuse. 

Retrieval of the boosters, parachutes, and other recoverable 
objeccs will be accomplished using surface vessels. The retrieval 
vessels will tow the boosters to KSC ; other objects recovered will be 
brought onboard the vessels themselves. Shuttle developmental 
launches will, of course, be used to test and refine vehicle recovery/ 
retrieval systemB. The boosters are expected to Impact at a point 
some 130 to 150 nautical miles downrange In an Impact footprint 
defined as a 10 X 33 nautical mile elllps . Once the boosters are 
located and the vessels are near enough, divers are sent to plug the 

nozzle. 
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Then the booster is dewatered and it attains what is called a 
"log" mode. Parachutes are coiled on reels and the nose cone frustum 
is lifted on board the vessel and the boosters towed home. 

Current Status 

The retrieval system definition is in its early stages and will be 
examined in more detail as the necessary design, interface and 
operational details are worked out. Among the questions yet to be 
answered are the number of tracks to have on the SRB impact recorder, 
and the baseline for the "station set" used in the SRB retrieval and 
disassembly 

3.5.2 Landing Facilities and Landing Control 
Systems Design 

These facilities and controls can bo divided into the following 
specific items: (1) Primary landing sites, KSC and VAFB used for 

test and operational flights, (2) secondary landing sites with particu- 
lar emphasis on Flight Research Center/Eduards AFB used for the 
Approach and Landing Test program using the carrier aircraft, and 
(3) the Mission Control Center at Johnson Space Center, Houston, 

Texas . 

The Orbiter Landing Facility at KSC is located approximately 
1,5 miles north and west of the Vehicle Assembly Building (VAB) and 
extends 15,000 feet to the northwest. It is composed of the following: 
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(•0 Airfield pavements of If, 000 ft x 100 ft: with 1000 ft. 


overruns on ouch end, a two-way that la 10,000 ft. loop, and r >0 ft. 
wide* leading to the Orbiter Process ing Facility, and a parking apron 
ju8l off the main runway and coincidental with the two-way 490 ft. x 
r ) r >0 ft. 

(b) Airfield lighting along the standard approach, runway 
touchdown and center 1 i no , and the runway edge. 

(o') A landing aids control building at the southeastern 
end of the runway containing hardware for flight and ground control 
including, the Orbiter landing instrumentation system with S-banJ/l’llK 
coinmtnioat ions , TACAN, Microwave Scanning lie am Landing System (MS1YLS1 
and related installations. 

Current Status 

1’he current status of the Orbiter landing facility at KS0 is as 
fol lows : 

(al Construction awarus have been made tor I’hase 1 and IT 
and the requirements for I’hase 111 are in t lie planning stage. 

(hi I’hase 1 construct ien on the runway, two-wav, parking 
apron, arilleld lighting,, electrical power and water mains is to be 
completed in August l"7t’. 

(c> I’hase 11 construction on the lauding, aids control building, 
insl rumen! at ion lacilitv, utilities support and cabling, svsteins is 
expected to be completed in September l l, /n. 
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(d) Phase III, TACAN, Communication systems (MSBLS, Comsoe, 
etc.), propellant and Bases systems, high energy ah" point, 

cine theodolite system, Orbiter mating device, and other landing 
support equipment are. all in planning and requirements review stages. 

(e) Test planning includes the utilization of the Shuttle 
Training Aircraft to validate the ground landing aids and control 


systems . 

(f) Significant issues at the time of the Panel review 
(March 1975) were: (1) Additional facilities required for cinetheodolitea 

and Che high energy aim point, (2) Runway grooving spacing which is to 
be between 1" and 2”, and (3) While the microwave Scanning Beam 
Landing System has been selected to support the Orbiter landing, its 
location at the end of the runway is under discussion (i.c., on the 

centerline or off the center line). 

The current program specifications call for the Johnson Space 
Center's Mission Control Center to retain control of the Shuttle 
elements (vehicle and, particular ]v , the Orbiter) throughout the 
mission including entry, landing and rollout to a stop on the runway. 
There is still some discussion as to the best location for control of 
the Orbiter during the Terminal Area Knergy Management portion of the 
mission (from about 70,000 ft. altitude to roll-out on the runway). 

The Panel will follow this question until its resolution to assure 
that crew safety and successful vehicle return receive appropriate 
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11,0 ShuttlK Turnaround Analysis Report (STAR) is prepared by KSC and 
is .submitted to the JSC Spare Shuttle Program Office to depict 
the current status of the operational turnaround functions. 

KSC considers the following four basic areas in developing the 
operational team concept: (1) Definition of functions in detail, 

dc « rec of autonomy to be provided. (J) depth of management 


oversight required, and (A) the varied personnel skills necessary to 
achieve the turnaround objectives. 

The handling of the Orbiter TPS is one. of the more difficult 
assignments during the turnaround period. Inspection and refurbishment 
will require constant attention to assure the adequacy of the TPS for 


the next mission. The TPS tiles are fragile in comparison to most 
other Items on the Orbiter and must he handled accordingly, A major 
element of the post landing operations at KSC is the performance of 
preliminary checks of the TPS surface to determine in a gross manner the 
quantity o! damage sustained during the mission and particularly during 
entry and landing. Once the vehicle has been taken to the Orbiter 
Processing facility a detailed examination of the tiled surface is 
nude. The methods hv which this will tv done have not been fully 
defined, hut will he examined in the future reviews. 

! in- haunch Processing System makes use of modular, or building, 
block, structure which will allow the hardware and software to he 
configured to accommodate difiering requirements in the checkout, 


maintenance, ami launch functions. In tin* launch support con neural Ion, 
test enplnoors, roannlnp l.l’S consoles In t lie haunch lUuitro) Center, 
perform teal Inp, anil prepare lor launch. The l.l’S In the maintenance 
aiul checkout con fi pu rat Ions has l.l’S consoles located In areas such as 
the Orbiter Processing Facility, Vehicle Assembly Ruildlnp Hiph Bays 
and Hyperbolic Maintenance Facility. The followlnp points were made 
to the Panel ropardinp the reipii remen t s tor the l.PS in the checkout 
coni i purat ion: 

(al To so automation - taster, repeatable, better discipline, 
realtime test results; 

(10 Standardization of hardware and software - computers, 
displays, data transmission, hardware interlaces document at ion , 
tra ini up and maintenance; 

(el General purpose/hi ph density consoles - lower operations 
per svstom, more burden on I lie machines and th multiple use ot equipment; 

(d 1 Test enpineer oriented ianpuape to eliminate middlemau- 
propraninor , make enpineer responsible tor the entire system; 

(el Rapid aceess to enpineer inp data and work control 

aval cm. 

Open issues al t he t ime .'I the Panel's review Inc lmh'd the con* 

(inn inr. review ot requ i remen! s lor the sv stein, preliminary desipn 
review planninp and development flipht inst rument at ion data processinp 
amt IPS requ i rement s tor the P.iv leads. 
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Tlu' station sot is defined as an aoommilat ion of units of (ISK required 
to support a spool fir art lolly or phaso of vohiolo assonibly, tost 
Jaunoli or pro-launch. Thoro nro tliroo typos of i!SK units or models 
In order to affect the proatost doproo of cost effectiveness. These, 
are: 

I'ypo L - Critical to lbO-hr timeline or final system 
verification or hazardous operations. 

Type IT - Functional interface with the vehicle. 

Type 111 - No vehicle interface or interfaces with vehicle 
hut requires minimum dosipn control. 

The Panel asked about the requirements with respect to reliability 
and safety. Tin* followinp requirements and philosophy apply: 

(al The haunch essential and satetv critical pround support items are 
identified and that particular list is updated and provided to ma na po- 
me nt lor their tinders' .ndinp ami control, (hi Failure Modoaml Kf feels 
Analyses (FMI-.A'sl and lia.-ard analyses arc required lor all lauudi 
essential and safety critical CSF, (cl All launch essential and salety 
critical OSF require that tor the eevt i Meat ion program, acceptance shall 
consist of one or any combination ol analysis, similarity or actual 
test i nr,. 

One ol t he open quest ions to he resolved is the t ime linos ol 
document at ion data I rom the element contractors lOrhitor, Internal 
rank. Solid Koi-kot booster, Space Shuttle Main I'nc.incl which allecls 
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KSO'h ability to plan lor ami define spares ami maintenance require- 
ments ami affects the lari lit v design activity as well. 

One of tin* challenges during turnaround will bo tho assombly of 
l ho total Shuttle vohiolo, since Shuttle elements roqulro vory tight 
stacking tolerances, woll designed equipment, ami woll trained 
personnel to assure proper control of stacking procedures. 

Factors bo I no, considered now in tho design of the mobile launcher 
and launch pad are: 

ls»l Fngtne exhaust rebound back up into the space vehicle 
creating a v ibroacoust ic problem, as well as thermal problems. 

(.hi The engine quench system (water svslem), 

(cl rite hole-si.* ing in t lie plat form to accommodat e the 
Sol ivl Kockot Booster exliaust . 

(.dl The requirements tor pavload unbil teals. 

(el Facilities to ininimice Fxternal Tank ice formation and 
at tecis ol ic. shedding . 

f l 1 Orbit or thermal Proloelion Subsystem tile protect ion. 

(,gl Favlead luu.il ing requi rement s and their implementat ion, 
e . g . . t lie pavload cleanroom ta.il it v. 


4.0 SAFETY, RELIABILITY, DUALITY 


4.1 S ystem Design 

For our purposes reliability (probability of failure), quality 
(excellence in producing hardware /so ftware ) , safety (freedom from 
injury or loss) are all a part of the so-called "Risk Management 
System" or "Space Shuttle Assurance Program." These are obviously 
interrelated activities and as such are not covered separately in 
this document. 

The Space Shuttle risk management system is built on prior manned 
flight program experience and modified to meet Shuttle requirements. 
Safety analysis process is shown schematically in Figure 48. Each 
of the element contractors and each ot the participating NASA Centers 
conduct its own safety, reliability and quality programs. In addition 
the Rockwell international Space Division in Downey, California, as 
Lhc system contractor, conducts an integrated safety analysis oper- 
ation. The total Shuttle program requirements including reliability, 
safety and quality are delineated in the Level II program requirements 
documents .ISC 07700, Volumes 1-XVMI. Compliance with these require- 
ments is further addressed in numerous documents. For instance, the 
approach to reliability is addressed in Volume l, "Master Veti I icat ion 
Plan." Volumes It through V have the requirements for the element 
verlt icat ion plans. lhc element ver i i i cat ioi\ plans describe the way 
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the requirements are to be met, e.g., test, analysis, and inspection. 

The specific plans covering reliability, quality and safety are sub- 
mitted by the element contractors to the appropriate project elements 
in NASA for review and approval. 

4.2 Major Reviews 

The major risks and uncertainties determined by various assess- 
ment teams and permanent organizations are reviewed by management as 
a part of their review system. The Preliminary Design Review for 
Orblter No. 102 and the Shuttle System Preliminary Design Review are 
examples of such events. Figure 49 shows that at the time of the 
Orbiter 102 Preliminary Design Review twenty (20) subsystem failure modes 
and effects analysis documents have been issued. These documents 
covered 947 components in terms of possible failure modes and their 
impact on the crew anil mission. 

The Safety Analysis Report indicated 200 Orbiter hazards and the 
corrective actions being taken, 'litis analysis covers such situations 
as: (1) illness/ injury/ loss of personnel, (2) collision/ impact/erosion, 

(J) tirc/explosion/ implosion, (4) loss ol or unsafe environment, (5) 
crash landing/ditching, and (b) loss of flight control. 

Hazard analysis is performed at tlv- subsystem level and, in cases 
where Failure M de Kffect Analysis have identified critical items tor 
the Critical Ttems hist , the analysis is performed to a lower level 
o t de tail. 
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The Critical Items List contains the single failure points and 
criticality 3j items identified by the FMEA • Criticality 3i are all 
those items not having a potential effect on loss ot life or vehicle 
or loss of mission. They also meet one or more of the following cri- 
teria: (1) redundant elements are not capable of checkout during 

normal ground turnaround, (2) loss of a redundant element is not 
readily detectable in flight, or (3) all redundant elements can be 
lost by a single credible event or cause. 

4.3 Safety Analysis Process 

The safety analysis process for the Shuttle program is being 
implemented in the following basic steps: (11 identification of safety 

concerns, (2) analysis of safety concerns for credibility and criticality, 
(3) initiation of Shuttle hazard analyses, and (4) tracking and closing 
out Shuttle hazard analyses. Kach of these steps is described below. 
4.3.1 Identification ol Safety Concerns 

A system safety concern is any design or operational issue that has 
a potential impact on personnel or hardware. The concern may be identi- 
fied by any person or organization on the program and must be dispo- 
sitioned. For instance, the system contractor's safety office re- 
views the element contractor's hazard analyses and I’MEA's to determine 
il a possible satety problem may propagate across elements of the Shuttle 
i rout an idem i lied hazard or failure on any one element. 

The system contractor's satety otliee also reviews the planned 



operations of the Shuttle tor potential safety problem. Thts l 3 to 
be done tor each mission phase. In addition there is a continue etfort 
by Rockwell international'. Space Division engineering and other groups 
to identify other issues which have a safety Implication, 
foobysla and Resoluti on of Safer, Concerns 
Every safety concern identified to the system contractor's safety 
office will be analysed for credibility and criticality. Credibility 
means that there is a real possibility that the event may happen. 
Criticality means that, if the concern occurs, there would be personnel 
injury, loss of the vehicle, or major damage to ground facilities. If 
the concern is both credible and critical, then action has to be taken 
to preclude undesirable consequences or minimise possibility of occur- 
tence. If the concern cannot be resolved, management must review and 
decide upon the risk to be accepted. Experience has shown that the 

8 reat majority of the safety concerns identified can be shown to be 
not credible or critical. 

4,4 buttle Sys tem Safety 

safety concerns as presented to the Panel during its hay inspection 

trip to the Space Division of Rockwell International are shown in 
Table XI. 

Ibe hasards resulting from fluids used throughout the Shuttle 
mission, with particular reference to the fire and toxicity problems 
are outlined in Table XII. thtly two phases of the mission would appear 
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to be essentially clear of problems, the ascent and orbit periods. A 
partial resolution of this problem was to separate incompatible ma- 
terials and environments by compartmentizing or sealing off of the 
Orbiter where practical so there were no hazardous fluids in the 
pressurized crew compartment. In addition to sealing off compartments, 
an active purge, such as dry nitrogen gas, is used to dilute the con- 
centration of hazardous gases. Warning devices have been developed 
to alert the crew and ground control. Contingency procedures at 
launch pad and during mission will be formalized. Figure 50 depicts 
this approach schematically. 

The Orbiter flight vent and purge system described in Section 3.1 
"Orbiter Element" to minimize the hazardous gas problem is augmented 
by the ground hazardous gas detection system designed and developed 
by the KSC organization. This ground system has been defined and 
the remaining major development items are the sensors tor the cryogenic 
and hypergolic portions of the system. For the cryogenic subsystem, 
these are mass spec trometor , electrochemical sensors, and portable hy- 
drogen sensor. For the hypergolic subsystem these are the portable 
hypergolic sensor and the air oxidation chemistry analyzer hardware. 

The flight system operation depends upon defining what is a hazardous fluid 
condition. For example, dissassocint ion of leaked fluids must be known 
for detection and hazard assessment (N 2 O 4 in humid atmosphere forms 
nitric acid) as well as autogenous ignition temperature at altitude 
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(low pressures) for Orbiter fluids. These data will be obtained In 
the coming months through a aeries of lnhouse and contract activities. 
Current Status 

The Panel requested that the following safety concerns be dis- 
cussed during their visits to both NASA Centers and Contractors. Each 
of these concerns is presented below along with the current status at 
the time of our review. 

Solid Rocket Booster Ignition Overpressure - Large over-pressures 
on Orbiter and External Tank structures and surfaces may be imposed by 
the booster exhaust shock-wave at Ignition. The over-pressure wave 
is assumed to reflect asymmetrically from the pad flame deflector 
and travel up the vehicle, applying pitch plane loads. Tests are to 
be conducted on a Shuttle model at MSEC to acquire valid pressure dis- 
tributions and intensities. Resolution has been targeted for November 
1975. 

Unscheduled SSMK Shutdown During Boost - SSME design provides 
internal, automatic shutdown mechanisms to achieve safe engine shut- 
down when critical performance parameters are not within tolerance re- 
quirements. Investigation has shown that the remaining two engines 
are necessary to achieve intact abort, and that a two-engine -out con- 
dition may well result in vehicle loss. One approach being studied to 
resolve this concern is to have a single engine shutdown inhibit or dis 
able the internal shutdown mechanisms tor the two remaining main engine 
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Thia inhibit capability would be accomplished by automatic electrical 
"lockup" of the engine control valves in their last position, and 
by incorporating an inhibit coil on the emergency shutdown solonold. 

C rew Rescue From Orbit - If for any reason the vehicle is unable 
to return to earth from orbit, no rescue capability exists during the 
early flight test program, but a "rescue orbiter" would be available 
during the operational periods. Various ideas are being explored 
to achieve a rescue capability d uring the early flight test portion 
of the program. 

Solid Rocket Booster Thrust Mismatch - Booster thrust mismatch 
can occur at any time during the burning period. The periods of greatest 
concern are at liftoff, maximum dynamic pressure and at the end of burn- 
ing period (tailoff). During liftoff, the specification lor the 
Shuttle system calls for a maximum mismatch of 300,000 pounds. This 
value appears conservative based on results of Titan TIIC statistical 
analysis of ignition transient. Ignition transient is still being 
evaluated by MS FC/Thiokol/ Rockwell Lor better definition of the time 
mismatch action. The impact of a mismatch at the maximum "q" condition 
is to add an additional load on the flight control system elements in 
the yaw direction. The Shuttle structure and flight control system 
has the capability to adequately account for such additional loads. 

The Booster tailoff thrust differential indicates that a 710,000 
pound mismatch is controllable with normal control capability. The 


710K value baft bran rfttnbUftbrd a. a requlieneut which occur, about 
11', ftreonda altar HtnUlon. However, whea boo-wr norrlr actuator 
or SSMF. TOKlncft fall the ftoparot inn ot the llooatar Iron the Luwtul 
Tank la delayed for up to /. •teeonda t o reduce the tnlstnatch throat and 
provide acceptable separation conditions. Ihe extent ot the control 
capability that can be exerted durlns tatlolf continues to be studied 
to assure adequate flight control and separation ability. 

4.5 Orbiter Safety Concern* 

Orbiter Structural Elements 

Structural deformation may prevent emergency egress from crash 
landings. Orbiter 102, to be used for first orbital flights, has 
added overhead escape panels which are used in conjunction with 
ejection seats, but the panels will remain after ejection seats are 
removed. There is a current study to ascertain the value of using 
the overhead hatches on all Orbiter*. The ability to compartments 
or isolate hazardous fluids is discussed in the fire/toxicity section 
above. There must be continuous control to assure that hardware 

assigned to the "structures' 1 category does not include items similar 

to the Sky lab metoroid shield. 

boors 

Ute major point is that during entry all doors musl be closed, 
ft the payload doors do not close then the crew must use EVA and 

continuing studies on elimination ot doors 


secure them. Ihe re are 


and methods of assuring the t r proper positioning throughout the 

mission. 

Payload Retention 

Payloads must be adequately constrained during normal or abort 
landings to avoid damage to the crew. 

Thermal Protection System 

This has been covered in detail in Section 3 . 

Hydraulics 

Loss of flight control due to failure ol single actuators which 
are used for elcvon control was studied by Rockwell International and 
NASA. They accepted the risk of being involved in relying upon a 
single actuator. 

Ejection Seats 

The possibility ol collision between the ejection seats following 
ejection is under evaluation at this time. 

Orbital Maneuvering Subsystem 

Large quantities of OMS propellant requires that i t be managed 
to assure proper center of gravity conditions during nominal and abort 
trajectories. Orbiter aerodynamics analysis and mass properties 
analysis are being performed to determine allowable residual pro- 
pellant quantities and the quantities to be dumped. Ihis work is 
expected to continue through the next Li seal year with resolution 
at the end 01 that t imo. 
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Dal a Processing System (Software) 


'leuorle software errors may nol he deterred in the noil ware verl- 
f I cation program based on prior experience in this area. A study is 
under way to determine the decree oi degradation due to expected errors 
and possible work-arounds to maintain operational control. 

Hydrogen fire Pur inn KTLS Abort 

During the return to landin;; site abort a hydrogen concentration 
is expected to exist in the wake ot the Orbiter. Hie location of the 
exhaust, vent, and dump locations are a safety concern. 
Landlng/Peceletatlon Subsystem 

The Panel has questioned the ability ot the landing gear gravity 
deployment system to support the Orbiter banding trajectory (altitude, 
time, distance). What is the basis tor confidence in the reliability 
of the free-fall system that landing gear will be in the down and locked 
position? When working properly is there sufficient time to achieve the 
down and locked position prior to touchdown? What contingency plans 
are available if the landing gear system does not operate properly? 

Because ot the Panel's interest in this area a brief description 
of the gear units and doors and their operation during, landing pro- 
vided here for a better understanding, ot the above three questions. 
Figures 51 and 52 show the nose gear and main gear installation. 

The nose gear retracts forward and up in the forward fuselage, 

and the main gear retracts forward and up into the wing. The weight 
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of the nose gear system is about 1300 pounds and the individual main 
gear about 2500 pounds. Crew selection of landing gear "down," after 
the arm switch has been selected, accomplishes two functions for the 
nose gear. It energizes the landing gear selector valve, porting 
pressure to he down-side of the nose gear strut accuator and the 
down-side of the uplock release actuator. In addition, a redundant 
pyrotechnic backup system is sequenced to release the uplock, if the 
primary hydraulic system fails to operate in a "short" period of time. 

There is only one primary hydraulic power system configuration for 
the nose gear operation. The gear then "free falls" from the wheel well, 
there by driving the mechanically linked doors open. Aided by weight 
and aerodynamic effects, the gear should reach the full down position 
and be locked in position by the action of a spring loaded bungee. 

The motion of the gear before locking down will be damped by an oil 
snuboer to prevent any damage to the locking linkage. Down pressure 
to the strut actuator aids in he extension cycle, but in the event hy- 
draulic power should be lost, it is not required to extend or lock the 
gear down. Gear down lock and gear/door uplock switches provide cock-pit 
indication of gear position. The extension cycle is designed to be 
accomplished at all velocities up to and including 300 knots within 
a time limit not to exceed 10 seconds. 

The main landing gear extension cycle is identical to the nose 
gear with the following exception. In place of the backup pyrotechnic 
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release system, l wo nddiiiounl secondary hydraulic sysl ems are pro- 
vided lor t hr up lock release actuator. Therciore, crew solorl i. on ol 
Land i up pear "down" ports down pressure I rom the primary hydraulic system 
to the strut an ua tor and to l ho up look roloaso aotuator. It si ton Id. bo 
notoil that any ono ol tlu* throo systoms is suliicieitl to roloaso tho 
main pear and door uplooks and inti into pear extension. Primary prossuro 
* tho strut aotuator aids oxtonsion but is not roiptirod, as tho wciphl 
and aorodynamio ol loots on "tree tall" poor aro sutlioLont lor pear 
oxtonsion and lockinp via a sprinp bun poo . 

There is an Autoland System intortaoo with tho land i up pear systom 
which lias not boon lullv dot mod as yot . Oporat ion ol tho pear, durinp 
tho landlup, oporat ion, is actual od as late as 14 seconds bo loro touchdown. 
Manual pear extension is achieved by the pilot throwinp a pear extension 
switch alter he sees a l i phi on the display panel. It is expected in 
the Autojand system that the autoload hardware would accomplish the 
same action at about live same time. The problem then is obvious. With 
a maximum ol ten seconds allowed lor the pear to po into the down and 
locked position and the act ton initiated some 14 seconds ho l ore touch- 
down, there is little it any leeway tor problems in response or de- 
ployment. There I ore, the reliability ol the system must be very close 
to 100 percent durinp that 14 second to 4 second period prior to 
I ouelulown or some alternate action capability must he supplied nlonp 
with a loupe r period to achieve down and locked pears. 



4 . () Kange Safety 

Current requirements have established the range safety system as 
an add-on unit only tor the design, development, test and engineering 
flights. The baseline system is shown in Figures 53 and 54. This 
system is still under discussion between NASA and the Air Force. 

Basically , the range safety system is required to provide for: (1) 

safety of Uvea and property, both on the ground and in flight, (2) 
External Tank propellant dispersion, and (3) protection against overt /co- 
vert destruction oi the vehicle and against ''false alarms" due to electro- 
magnetic interference or spurious signals. 

Issues under study at this time include the following: 

(a) External Tank propellant dispersion and their impact 
on Orbiter (MSEC). 

(b) Crew ejection seat inhibit which inhibits range salety 
system operation. Adequate procedural safeguards and time delays 
appear necessary to maximize astronaut survival it destrucl action 

is required. 

(e ) Shutting down ol the Orbiter's main engines upon re- 
ceipt ol tlie range salety .lest met system arm signal. 

(d 1 Ini light sating, ol (he "sale and arm" device by llu* 

Orbiter so l l ware. 

(.■ 1 Monitoring ol l lie sale and arm device to prevent in- 
adverl am sal lug. ol the range saietv dost met device. 


f * ' ! Materials Haapo and Com r .i 1 


0u,> ol management 's major controls lo assure the design ami con- 
st ruu Ion ot sale ami elticien. hardware Is In the materials' usage 
men. litis includes not only the compatibility ot materials wit 
their environment front the stamlpoint ot l lammabi lit y ami toxicity 
but also with regard lo their stress eorrosion/l racture mechanics 
suscep, ability. 1 he Shuttle program, using the experience gained iron, 
prior manned programs ami militaiy ami conmcrcial activities, has 
developed materials' programs tor each element as well as tor the 
nil curated Shuttle system. Requirements set by the prop, ram amt 
at feet i up all elements within the propram are set torth in Paragraph 
1 . n . . 1 , JSf 0 -'00, Volume X, "Spaee Shuttle I'lighl ami Oreuml Systems 
t'peei i teat ion," ami the .ISO document SK-K-OOOnA, dated April l ‘>7 
"Requirements tot Materials and ('recesses . " 

these requirements inelnde the tol loving: 

tal inch clement must have a controlling doenment on 
materials and processes statin,; the spec , licit , ons and standards to 
be used. Hie re is a drawing review and sipn-oil bv a materials’ 

r i \ \\ i m*i't . 

Materials testing and "allowables" ate covered by : 

iai : lanimabi I t i \ , odor, out pass i nr in NASA NHIt HObO.lA. 

I* 1 ' llterma I -vaenum stahiiiiv in NASA SP-K-OO.’.’. 

let Special tests as ap, Moved |. v . i S i whole it Is to It 
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that they are required to assure materials compatibility within the 
context of their use. 


(d) ASTM test methods are applied as required. 

(e) MIL Handbook No. 5, 17, 23. 

Material selection lists are developed based on experience and 
known material compatibility with specific environments. There are 
also fracture control and material control plans. Each element con- 
tractor has developed its own metals/nonmetals/processed which have been 
reviewed by and approved by NASA. 

The Space Division, Rockwell International Corporation, as the 
Shuttle system contractor, has developed a materials' tracking and con- 
trol system called "MATCO.” While they do not control the use of 
materials on the Shuttle elements, they do bring material usage which 
they feel falls outside the set requirements to the attention of the 
NASA/ JSC project office for further action. In addition, materials- 
conscious personnel participate in the Panel and working group activities 
as well as in the reviews conducted on Shuttle elements and subsystems. 
The Panel will continue to review this question of decision making on 

materials' acceptance during future reviews at various contractor and 
NAS \ sites . 


The "MATCO" 
metals and non-tne 
usage data on 


system noted above contains pertinent data on both 
tals, generates material selection lists, contains 
what materials are used, where used, quantity, re- 
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suUb of usage evaluation, deviation status where there is a deviation 
from accepted use, and finally the system generates output reports to 
permit certification of the acceptability for a given configuration 
usage . 

The "MATCO" system on the Orbiter has been implemented since the 
first drawing release. Associate contractors for other elements of 
the Shuttle program are currently encoding the data and it is 
expected that element contractor data outputs may start about January 
1976. Payload coverage is under discussion at this time. 

4.8 failure Mode and Effects An alysis O'MKA) 

Elements of the Shuttle system and the interfaces beteon elements 
are subjected to detailed KMEA's. in addition to the FMKA documents 
there are Critical Items Lists (Cll.'s), Hazards Lists, Shuttle Hazard 
Analyses forms (SUA’s), and Safety Analysis Reports (EAR’s). Taken 
together they provide a systematic means of assuring nothing, in so far 
as possible, "falls into the crack." They provide for early identi- 
fication and resolution of potential problem areas, support design 
reviews, provide management visibility, and establishes a documented 
baseline to facilitate hazard/risk/safety problem resolution. In 
addition ibis work p ovides a basis lor establishing mandatory 
tesi and inspection points under the ijunliiy Control Program and 
provides valuable input lor tin. maintainability program tor Shuttle. 

IW mioritv or level ot criticality number system is in use, 



as it has been in prior manned programs. The listing is provided for 
information : 

Criticality Category Definition (Potential Effect) 

1 _ Loss of life or vehicle, including loss 

or injury to the public. 

2 Loss of mission, including post- launch 

abort and launch delay sufficient to 
cause mission scrub. 

3 All others (structural or TPS type 

elements are not classified in any of 
these above categories if they meet the 
margin of safety requirements). 

3 j Criticality 3 items which meet one or 

more of the following categories: 

(a) Redundant elements are not cap- 
able of checkout during normal turn- 
around . 

fb) Loss of a redundant element is 
not readily detectable in flight. 

(c) All redundant elements can be 
lost by a single credible event or cause. 
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5.0 TEST PROP RAMS 


5.1 Verification Plans 

A Shuttle Master Verification Plan (JSC 07700- 10-MVP-01 Rev. A) 
establishes the requirements and plans to certify the Shuttle system 
ready for operational use. Since much of the program's confidence 
will be based on test requirements and results, the Panel has reviewed 
the evolution of the ground and flight test program including the im- 
pact on crew safety of changes in requirements. 

5. 2 Ground Tests 

In most ot the preceding sections of this report there have been 
discussions of test programs as they applied to the specific develop- 
ment of subsystem components, such as the tiles for the Orbiter Thermal 
Protection Subsystem. The ground tests discussed here are those termed 
major ground tests." Such tests involve a combination of system 
elements and complex iacilities. The major ground test programs are 
outlined in Figure 55. 

The ground vibration test program verifies load, vibration, 
i hitter, and flight control system analysis. Vibration testing is 
performed on a one-quarter scale Shuttle model and on the liquid 
oxygen tank portion of the External Tank. The first Orbiter will also 
be subjected to a horizontal vibration test at the Palmdale Assembly 
Facility as a part oi the vehicle checkout. The major lull scale 
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Space Shuttle vertical vibration testa are planned to be carried out 
at the Marshall Space Flight Center to study the vibration modes of 
the total assembled Space Shuttle vehicle. Recent changes in the 

ground vibration test (GVT or MGVT) include: 

(a) Deletion of component ground vibration tests on the Orbiter 

wing, Orbiter vertical fin, and other components. 

(b) Delay of the quarter-scale model testing for six-months. 

(c) Compression of the mated vertical ground vibration tests 

to a six months time period. 

The vibro-acoustic test program verifies the predictions about 
the dynamic response of the structure and internally mounted equip- 
ment to engine noise and vibration, aerodynamic buffeting and aero- 
dynamic noise. Wind tunnel tests of models have been used to de- 
termine the aerodynamic noise pressure levels. Scale model tests 
of the total Shuttle stack are being used to predict the launch en- 
vironment and its impact. Full scale tests of a major segment of 
the Orbiter are to be conducted in the vibro-acoustic test facility at 
JSC. Recent changes in this test program include the deletion of the 

forward fuselage vibro-acoustic test. 

The Main Propulsion System test program uses the three main 
engines mounted on a simulated aft section of the Orbiter, together 
with the External Tank, and includes all necessary plumbing and con- 
trols. 1*000 suppression hardware will be supplied for installation as 




the tep t 3 progress to substantiate the technique used to suppress 
the longitudinal vibrations peculiar to POGO. These propulsion tests 
will also provide additional vibration and acoustics information. 

Recent test program changes include the deletion of the vertical 
firing attitude, deletion of flight disconnects from the "T-0 Umbilical" 
and an increase in firings from 14 to 15. 

The Orbiter avionics components and their related software and 
hardware interfaces will be tested at the Rockwell International 
Space Division's Avionics Development Laboratory. The Avionics 
Development Laboratory is an engineering tool with emphasis on de- 
velopment support, subsystem evaluation and initial hardware inte- 
gration. Test results are aimed at; 

(a) Demonstrating line replaceable unit functions for all 
those pieces of hardware that fit that category. 

(b) Developing the single-string data processing system 

l'unc t ions . 

(c) Avionics compatibility with automatic ground checkout 

equipment . 

(d) Progressive testing and combining of subsystems until 
they simulate a flight coni rol system with computer inputs and control 
actuator outputs. 

The Shuttle Avionics Integration Laboratory (SAIL) established 
at JSC will conduct avionics systems integrated testing in support of 
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the Approach and Landing Tests (ALT), Vertical Flight Tests (VFT), 
and operational mission phases. Integrated testing includes both 
open-loop and closed-loop testing. Open-loop testing will integrate 
and verify the avionics system compatibility and redundancy manage- 
ment techniques; closed-loop testing will integrate the avionics 
hardware and software systems and verify that they are capable of 
performing each flight phase of the mission. Thus the SAIL is a central 
facility where the avionics and related hardware (or simulations of the 
hardware), on-board ground support software, flight software, flight 
procedures, and associate 1 GSE will be fully integrated and verifi- 
cation tested. Figure 56 shows the Shuttle avionics systems which are 
to be tested on SAIL. 

Another facility supporting the avionics test program is the Soft- 
ware Development Laboratory (SDL). The purpose of this facility is to 
accomplish flight software development and flight software independent 
verif icat ion. 

Static structural tests are planned for major structures on all 
Shuttle elements. A full-sized Orbiter airframe structural test 
article (STA) will be tested at Palmdale to determine if it can with- 
stand the design limit and ultimate loads. In addition, it will be 
subjected to fatigue loeading up to 400 cycles to assure structural 
integrity. An Orbiter crew module test article, which is the pressur- 
ized crew compartment segment of the Orbiter, will be tested in a 



manner similar to the static test an Ido mentioned above. 


The External Tank structural program includes a structural 
test article consisting of flight-type liquid oxygen and liquid 
hydrogen tanks and Intertank. Tests will he conducted to verify 
structural integrity at limit and ultimate loads and to determine 
the liquid oxygon tank model characteristics necessary to deter- 
mining the all-up Shuttle vehicle structural characteristics. 

Solid Rocket Booster and Solid Rocket Motor structural tests 
will be conducted, as will hot firings to verity their structural 
integrity, support development of the rocket motor case and verify 
ballistic performance. 

Recent test program changes have deferred the crow module 
structural test, deferred the airframe structural test, eliminated one 
inLertank structural test article trom the External Tank program, de- 
terred the Solid Rocket Booster structural lest and deleted the booster 
lirsi development tiring. 

The Orbiter thermal vacuum test programs on the forward fuselage, aft 
fuselage, and OMS/RCS pod have been deleted. The impact of deleting the 
major ground thermal vacuum test has been subject to study by both .ICS 
and Rockwell International over the past lew months. The following 
results stem trom these studies but must be considered in light of 
additional more detailed work now in progress: 

( 1) There is an obvious requirement lor l light lest da. a. 
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(b) There will be no off-limit or off-nominal testing to any 


degree. 

(c) There will be no physical pre-flight data on temperature 
effect of subsystem operation on the integrated vehicle. 

(d) There will be some restructuring of the certification/ 
validation program to include additional component and subsystem testing. 

(e) Requirement:* for additional development flight and op- 
erational ..'light instrumentation requirements will have to be determined. 

(f) Mission planning will have to pay more attention, in the 
early flights, to beta angle variations, time required for temperature 
stabilization. 

(g) Conservative attitude constraints will be necessary on 
the early orbital flights. 

Test article fidelity has always been a problem in extrapolating model 
tests and full size ground tests up to the actual flight hardware and 
how it operates in its real environment. The ability to extrapolate 
from ground test activities to flight operations depends upon the degree 
to which the test articles resemble the flight articles. A Flight 
Readiness Firing test (FRF) will functionally verify the integrated 
shuttle system vehicle, launch complex and operating procedures and thus 
demonstrate the maturity and readiness of the shuttle system for first 


manned vertical flight. 

The Solid Rocket Rooster /Internal Tank 
the Orbi ter /External Tank Separation tests 


separation syatem teBt and 
two major tests deferred 
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are 


to flight test program. The verification logic is shown in figure >7. 
The panel has made a point of repeatedly ashing if data were being loat 
from ground t-CRts that would be useful to our basis of confident e in 


crew safety during early flights. 

The answers given were: "No tests are being conducted during the 

Approach and Landing Teat and Orbital Plight Test programs which affect 
crew safety that have no counterpart in the ground test program. . . . 

All elements and maneuvers of the flight test program have counterparts 
in either ground tests, simulations, or analysis." 

5.3 Flight Tent Program 

The flight test program has two major subdivisions: The Approach 

and Landing Test Program (ALT) and the Orbital Flight Tests (OFT). These 
flight tests complement the ground test program described previously and 
the ALT is planned to commence in ir.id-1977 using the Boeing 747 carrier 
aircraft, and the OFT is planned to commence in mid-1979. 


5.3.1 Approach and Landing Test rrogr ,vm_ ^ALT) 

The Orb iter vehicle 101 (the first off the line) is the primary’ 
vehicle planned for the ALT and is configured to include the equipment 
necessary to evaluate vehicle approach, landing and deceleration re- 
quirements dictated by the terminal phase of the operational mission. 
The design of Orbiter 101 Is such that minimum modifications are re- 
quired to convert it to the operational configuration. 

The ALT program is designed to progress 


from test; conditions that 


provide the greatest margins of safety to teat conditions duplicating 
those expected on the first Orbital Flight Test landing. The ALT pro- 
gram is comprised of two flight test phases i 

Phase 1 - Inert Orbiter/747 mated tests to verify satisfactory 
airworthiness of mated vehicles for supporting orbicer free flight tests. 

Phase 2 - Manned Orblter captive flights to develop Orbiter release 
profile and Orblter free flight and landing data. 

During ALT the Orbiter is flown without any propulsive power. With 
the current capabilities of the Orbiter/747 combination, the maximum 
attainable altitude appears to be somewhat less than 28,000 feet, and 
with the loss in altitude which is said to occur during the release 
period the Orbiter would appear to be in free-flight starting at about 
20,000 to 24,000 feet. These tests are to be conducted in the area 
surrounding the Flight Research Center, Edwards, California. 

The status of the two phase ALT test plan is: 

PHASE 1 - 

(a) The extent of the initial Taxi tests of the mated 
Orbiter/747 at Palmdale has not been fully defined as yet. 

(b) The planning for ALT is being done by FRC, Rockwell and 
Boeing. Th.v will define the requirements under the review of the 
Orbiter Project Office at JSC. These requirements will appear in the 
Approach and Landing Test Requirements Document. The actual flight tests 
needed to meet these requirements will then be developed by the same team. 
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They will appear In the ALT Mission Objectives Doeum-nt. 

(c) The actual teat program will he cona true ted in a manner 
that will permit the achievement of object Ivea to get to the manned 
Orbiter release point with a minimu... number of flights and flight hours. 

(d) The ALT manager Is from JSC and the assistant manager is 
from the FRC. The tests are conducted for the ALT manager by the FRC 
flight test team and during these operations the FRC flight test control 
room will be utilized to control the flights. 

(e) The 747 test instrumentation system is designed and 
installed by the same team. It will be compatible with the FRC test 
control and data reduction facilities. Data reduction and analysis by 
FRC is conducted with JSC support and the same tapes and other data are 
forwarded to JSC for their independent analysis. 

(f) It is expected that during this phase of the program that 
Ferry configuration flight tests will be conducted in parallel on a 
non-interference basis. 

PHASE J - 

(a) Phase 2 begins at the completion of the inert Orbiter/747 
testing. The current baseline consists of eleven Orbiter free flights, 
starting with pi lot— control led landing series (S t lights); auto land 
landing demonstration (1 flights); and finishing with welght/c.g. 
envelope investigations (I i lights). These free-t lights are being 
structured to allow early termination of the program or ; o skip 
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ducted prior to flight will give a basis for confidence in the avionics 
subsystems used on the ALT program. In addition, the orbiter will con- 
tain an "all-up" fail operational/fail safe flight control avionics 
subsystem with a dedicated backup flight control subsystem and a backup 
air data nose boom system. At the same time the ground support group 
will have the support of Shuttle Avionics Integrated Laboratory, 

Software Development Laboratory, and the Avionics Development Laboratory 
available. 

5.3.2 Shuttle Training Aircraft 

The Shuttle Training Aircraft is a Grumman Gulfstream II turbojet 
aircraft modified to provide an inflight simulation of Orbiter perfor- 
mance and flying characteristics in the Terminal Area Energy Operations. 
The purpose of this training program using the modified Gulfstream II 
Is for pilot training and the development and verification of procedures. 
The simulation system consists of a specially constructed and programmed 
simulation computer and necessary inertial sensor systems. The displays, 
controls, radio, navigation systems are essentially Orbiter Hardware. 

The simulation capability is as follows: 

(a) Altitude - 43,000 feet to simulated touchdown 

(b) Airspeed maximum of 350 knots or Mach number of G.8 

(e) Payload of 5600 pounds 

(d) Orbiter modes simulation for automatic landing systems/control 
stick steering and backup systems 
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(e) Turbulence and wind conations expected to apply to Orbit or 


operations 

5.3.3 Orbital Flight Tests 

The culmination of the flight test program occurs with the manned 
Orbital flight, a program currently encompassing a sequence of six manned 
flights. The first orbital flight is designed to be short and benign 
to demonstrate basic flight worthiness. A decision was reached by senior 
NASA management to proceed with the design and development ol the manned 
first flight only after prolonged and detailed study of the manned versus 
unmanned options. A review of the decision will be conducted eighteen 
months prior to the first: orbital flight. A summary of the manned vs. 
unmanned study provided to the Panel is given below: 

(a) Recovery of the Orbiter on < very flight is required for 
orderly continuation of the flight test program. 

(h) Flight experience shows many cases where the presence of 
crew saved the mission from failure. 

(c) The crew role in the shuttle is identical to that in 
aircraft and spacecraft test operations; however, crew capability in 
some areas cf the shuttle design concerns is very limited. 

(d) Manned landings can be made at alternate sites in the 
event of dispersed entry conditions or .internal Ic system failure. Capa- 
bility of crew to deal with contingencies provides greater safety for 
the population in the landing area. 


(e) The ground teat program has been constructed to give 
confidence that design concerns have been acceptably minimized prior to 
thT first orbital flight, manned or unmanned. 

(f) Tailoring of the first vertical flights to improve safety 
margins will be accomplished as practical for either manned or unmanned 
flight tests. 

(g) Abort and ejection capabilities are consistent with 
aerospace testing precedents, that is they cover many but probably not 
all foreseeable failure possibilities. 

(h) Commitment to unmanned flight implies a successful 
Approach and Landing Test Autoland program as a prerequisite. 

(i) Unmanned capability requirement can be reinstated later 
if unforeseen circumstances demand. 

The early development Orbital flights will be launched from the KSC 
site and will land at Edwards Air Force Base. These flights are to be 
under the control of the JSC Mission Control Center once lift off is 
achieved. Depending upon the progress achieved in the early flights, 
there is a good chance that the fifth or sixth flight will both launch 
and land at the KSC site. 

The contingency planning and design for abort conditions during the 
flight test program will continue to be of great interest to the Panel. 
This is true for both the Orbital and ALT programs. The Panel, for 
instance, is interested in plans to assure that requirements of abort 
operations and system capabilities are compatible. 
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6.0 SYSTEMS INTEGRATION 


6.1 General Objectives 

The management of the integration effort has been covered in 
earlier sections of this report. This section is meant to Identify 
the technical challenges of Integrating the elements at this point 
in the Panel's review. 

An example of the many technical areas that must be managed to 
assure that the Shuttle elements work together are: 

Flight Performance 

Load and Structural Dynamics 

Flight Control 

Integrated Avionics 

Integrated Propulsion/Fluids 

Mechanical Systems 

Ground Operations 

Major Integrated Ground Tests 

Computet Systems and Software 

Systems Engineering 

Safety, Reliability and Quality Assurance 
Payload Accommodations 

The Main Propulsion System ii used here to illustrate the complexity 
of the relationships between components found in various elements which 
form single end-to-end integrated systems. Other areas to be examined 
by the Panel include electrical system and avionics system. 
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6 • 2 Systems Integration Challenges 


Some of the challenges the program muat reaolve on the Space 
Shuttle System are: 

Flight Performance Margins 
Induced Loads 
Tee/ Frost Shedding 
SRB/KT/orbiLcr Separation 
POGO Suppression 
Fore body drag 

Many of these challenges have been discussed in the section of the 
report on the various program elements. 
b.2 Operations 

The Orbiter is designed to carry a crew of up to seven including 
crew and scientific personnel. On a standard mission, the Orbiter can 
remain in orbit for seven days. While it is planned that an Orbiter 
would be readied for another flight in fourteen calendar days, the 
Shuttle can be readied for a rescue mission launch from a standby 
status within twenty-four hours alter notification. For emergency 
rescue, the cabin can accommodate as many as ten persons so that all 
the occupants of a disabled Orbiter could be rescued. 

Space Shuttle operations consist oi four basic phases: 


(a) 

Li ft -off 

to orbit i 

(b) 

On-orbit 

operat ions 
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(c) Do -orbit to landing 

(d) Cround turnaround to prepare for the next flight 
Operational constraints have been discussed in previous por- 
tions ol this report under each of the elements of the Shuttle system 
ns well as in the reliability, quality and safety sections. The Pan- 
el's interest continues to focus upon the ability of the nominally 
designed hardware to meet the contingency situations which can occur 
during flight test and operational phases of the program. We will 
monitor the evolution of the launch rules and the mission rules gov- 
erning both test and operational flights. We will also monitor such 
safety challenges as (a) intact abort capability, (b) contingency 
abort capability, (c) payload accommodations, (d) day and night oper- 
ations, (e) mission control center requirements, (f) post landing 
thermal conditioning, and (g) KVA operations. 

0.4 Main Propulsion System 

The Main Propulsion System integrates the Space Shuttle Main 
hngine (SSME) , hxternal Tank (KT) , and the interconnecting plumbing 
and controls within the body of the Orbiter. The subsystems that 
make up the main propulsion system are: 

(a) Propellant feed 

(b) Propellant fill and drain 

(el Kngine prestart propellant conditioning 

(d) KT pressurization and prepressurization 


(0) Ho Hum storage and distribution 
(f) Propellant management 

(p) SSME C!N 2 purge using ground supply 
(h) POGO suppression 

(1) Electrical instrumentation, controls, and displays 
A schematic ol this system is shown in Figure 58. The selected 
POGO suppressor system is shown in Figure 59 and the workings of the 

POGO Integration Panel are shown in Figure 60. 

The Main Propulsion System has been designed to meet the fail- 
safe criteria. Thus, tor example, loss of one main engine during 
ascent would still permit, the crew to abort a Mission 3A as follows: 

0-250 seconds suborbital powered return to 

launch site 

250-330 seconds abort once around 

330 - main engine cntol l ... mission completion 
Shutdown Of two of the main engines will result in loss of 
the Orbiter for a majority ol mission phases during the -scent. 

Prevalves, till valves, and disconnect valves are all designed 
io remain in the last actuated position, in the event ol loss of 
pneumatic pressure to the valve actuator, or loss ol electrical 
power to the controlling solenoid valves. Pneumatic pressure is 
continuously applied to these valves during their critical l unction 
period , to further assure their remaining in the desired position. 
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(> . !> Summary 


The 1’mu'l has examined n portion ol the efforts eoiuhuted in 
i nt ei»rn L inn >he iol.il Shut t lo sysl cm during tin- pant reporting period, 
Willi i he completion ot the Preliminary Design Reviews lor each of I hi' 
elements and the Space Shuttle System, the Panel can better under- 
take a review ol the Integrated systems which cross over elemetu in- 
terlaces such as the electrical system, and the mentioned Main Pro- 
pulsion System. 
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j . 1 l*At:r.L At'TIIOjMTY 


A, '.'in, pare S.M. I V Atlv l SOI V was undo, .be, <•« " 

Nn.lonal Aero., a, dies and Spa.-. Ad„ Au.horO'a.ioi, AH, 

V9hH (Pt, 90-..7 , 'AH I. Com'. Hi. 9, HI dial. l'.H, UO). 1" “ M 1 1 

1 has boon rooharloro.l purauam ... Hoo, ion 19 <10 ... .bo I edei-nl 
Advisory Conm.il too AH, 09. 9.-9,. I. <•. M»>. '9,0 .Unios ... 

,:Ho I’.n.el are sol lor.h to boll, .bo Wo* Ac. and in NASA Mannr.omnm 
I ns.ruo riot. 115b. 19A da.od January ,H. 197., "the Panel sha.l roviow 

sale. y sLudios and o,.ova, ions re. or red H »>"'H «*» 

pnris Ibotoon, shall advise «he Adini nls, rator wl.h tospee. ,o Itoe ba.iards 
proposed or exist In,, ,aoi,i.i"S and proposed opora.ions and will, re- 
spool lo l lie adequacy o, proposed or exist nip sa.olv s.and.nds, and 
shall per lorn, such other Junes as .he Ad»l»l..r»».r «»* roques,." 

Over .ho years ,he Panel has role in. l»'do - only 

sa.o.y per so, bul has Ineludud mission sneeess as a eons idoral ,.m .In. I 
should bo eoneernod „l.h, as coll as How or public safely. We leel 
„,is hr he poo.'.rains Uiei, man.,,, I 

,,i„es us more evidence I" <•» 


1 88 


7,2 1 'AN Ki ._Ai ; T 1 V I TINS 


lamia ry ]'», 1974 


I'obrnarv ’<>, 19/4 


May 1H-14, 1974 


him* '»-h, 1974 


lu I v 1 b- 1 7 , 197 4 


MltAC-Nasi Ho)i> In Shut lie I'rngrain 
Organ I /.a! Ion 

(irh i i a I Maneuvering System 

Hanoi I no, Schedule, Stains 
Ini egret inn n! I’nd into Orbiler 
Heart ion Control System Requirements 

I’rogram Nana ja r's Top View 
ITS lirve I opim-nt Slat ns 
Systems I nl or, ra i ion Management 
Man- in-The- Loop 
l'« • r rv Mo»lo 

I'mliminary Design Review Re s til Is 

The Kxlornal lank l’rogram, Overall Viow Mirlmml Assembly 
I’ Ha so 1 i no 1’ lant , I A 

Des i r,n I’rogram 
I nli’f taros 

Major issnos and thoir proposed 
I'l’so I tit i on . 

I.ightning Hrolootion Design 

Transport a l i on 

St: nir I lira 1 Tost Program 

Reliability, ntialily Assuranco and Safely 
Stdn-ont raotor program 

MSI-’C Management of l ho Kxlornal Tank Program 

SSMi: ouarterlv Review MSFC , llimtsv i 1 le 

SSMF Controllor discussions 

Spaoo Shuttle Main Fngine Controllor lloneywe 1 1 , Aero- 

i’rogram Overview Space Div., FI A 

Hospons I hi 1 i l: ios , Sole, Organisation 
Controller Technical Description 
Computer 11 ro gram Overview 
I* la I od Wire Memorv theory 
Moinorv struct tire build -tip 
reclinic.il Review in depth 

lies ion Control ami Configuration Management 
'’rodiiot ion ami ’roruronion I 
R f OA 

Summary States 

MS IV Management of SSMF Controller I'rogram 


MHAC , Ft , IiiiiIm, 
M i fuiour i 


.ISC-IIoiihI on 


August 


i <> ; i 


The TI'S l> i'll'. 1 , ra is 0'”r\' iew .out ISC Mgi . 
Amo-; 1 shell !■■ re i it • -t I programs 
Am-”; 1 V.an.i oet-ii-ni Aporo.n-h and iMpleimntat 


AMIS, CA 
I oe klieed , 

i on 


CA 
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t ies 

Ti le 

ma ter i a 1 s 
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If le 

Product ion 





Ti le 

testing. 






Ti le 

K and QA 







Current Slat is 

Current s i gni l i can I problems and their 
ri’Ho 1 ul i ons . 

lb-17, 197A R1 System ini egt at ion Contractor Role RT /Downey, CA 
Common. - ! lily 
System Safety 

System Integral inn Clin 1 l tinges 
Tour oi Facilities ami Mockups 
Orbit or Thermal Protect ion System 

SSMK Program update 
ISI'H Program Stains 
Combustion duvieos status 
Purbomnchi norv Devices statrsus 
Fngine systems aiul controls status 
Controller stains 

Orbiler Approach and landing Test Program .tSC/ilons ton 
Ferrv Ope rat ions 
Manned vs. I'nmanned 
Fxternal lank tlisnes.il alter flight 
Space Shut i le Flight lest Program 
Abort /font i ngenev operations and their imnacl 

Space Shull r'ml.ite ami Status Report ISO/llouSlon 

Approach and landing test , !'!>R results 
Avionics ami their management 

Management and I 1 i gee I ion o I Svslems integral ion 
MSFC Spate Shut ( le Survey and Major Management 
and I’echti i i‘,i 1 Fha I I epgeS 
Main Ingim-, Fxt>’vnal lank, Slth, Orbit or 
P roe. ram Revisions under act ive ct»us Ldera t ion 
Current status 
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March 3, 1975 KSC Space Shuttle Planning KSC, Florida 

KSC Roles and Responsibilities 

- Operations, Maintenance, 

Sustaining Engineering 

KSC Organizational Relationships 

- Overall Organization 

- Intercenter Relationships 

- Participation in Panels, 

Working Groups, Task Teams 

- Contracting Philosophy 

- Manpower planning 

Experience levels, skill retention, 
skill mix. 

Overview of Ground Operational Tasks 

- 9huttle 

- Payloads (offline) 

Documentation and Control 
Facility and GSE Overview 

- Types and KSC ef fort/Responsiblity 

- KSC facility baseline/current 
status/ problems 

- Test Facilities/Plans/Schedules 

- Launch Preparation System 
System Operation 

Software Validation/Test/Use of SAIL 
KSC Operational Flow 

- Ground turnaround 

Allocation vs. Assessment 
STAG/Control 

- Payloads, online 
Summary of KSC Shuttle operations 

April 7-8, 1975 Space Shuttle Systems (MSFC Elements) MSFC, Alabama 

- POGO Prevention Planning and 
implementation 

- MSFC Integration Activities 

- MSFC Change Processing 

- MSFC Systems Tests 

- Single Failure Point Designs 
Solid Rocket Booster Project 

- Description and Status 
Integration 

- Recovery /Retrieval 

- SRM 

External Tank Project 

Description /schedules/cost highlights 
Top Problem8/Sepc ial Topics 

Procurement and Manufacturing status and problems 
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May 5 - 


SSMK Project. 

- Overview 

Integrated System Test Red (ISTR) Plan/Status 

- Controller status 

- Hydraulic Fluid Status 
» Fabrication Learning 

- Heat Exchanger 

- Ground Operations Planning 

MSFC Summary 

197 Shuttle Assessment of Technical and Management Rl/l.A 
challenges 

Thermal Protection System Review 
Hazard Analysis and Risk Assessment 
Mechanical Hinges, Goat' Boxes, and Doors 
System Hazards associated with asymmetrical 
thrust of SRB's 

Procedures/Ground Rules to Alleviate System Fat Hires 

Hazradous Gas Detection System 

Level II Interfaces 

Material Usage and Control 

Range Safety 

Ground and Flight Test Programs 
POGO Prevention 

Lightning Design and Protection 
SAIL 
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* RESPONSE TO PANEL'S 1974 ANNUAL REPORT 

NAIIONAI. AERONAIIIIi S ANI1 SPACE ADMINISTRATION 

Wa>iIi.i«.ion. l> l' ,'OMh 

MAY Z'i W4 

MKMO RANDOM 

TO; AA/Assoeiate Administrator 

FROM: M/Assooiato Administrator for Manned Space Flight 

SUBJECT: Annual Report of the Aerospace Safety Advisory 

Panel (ASAP) 


. AVI , 



t- V A 


men ia 

AIIN 01 MO 


The Annual Report, of the Aerospace Safety Advisory Panel 
has been distributed to each of the MSF Centers and Program 
Directors for their careful review. The Proliant Directors 
have each coordinated responses to their pertinent items 
in the report and these detailed responses are attached. 

Significant responses from the ASTP office relate to 
Volume IT of the report, panes R-9, items 1 through 1.1. 

They describe a eontinuinu stroiuj program manaqement oon- 
eept: with emphasis on enhancement of personnel motivation 
and traininu. The Panel's eoneern over the need for formal 
reviews is heinu met by monthly juint reviews and bi-weekly 
t.eleeons between the U.S, and Soviet Technical Directors 
and their staffs. Oual if icat ion test data reviews are 
heinu continuously hold to assure a roady-to-go status. 
l.anuuaqe traininu is prouressimj wel 1 on both sides and a 
recent crew traininu exercise in Houston accomplished a 
complete trans l er in both P.nulish and Russian. FMl'A ' s 
have been completed for .ill systems of the CRM and DM/ 
doekinu system, Tlie Mission Font rol Cent.er Interaction 
Plan is in excellent shape and both countries plan a team 
of experts in each other's control room to assist each 
Fliuht Director. Mission simulations are eontinuinu with 
both U.S. and Soviet crews par I i eipat i nu in each other's 
laeililios. IMlorl is eonlinuinu on trackinu failures or 
inadvertent oper.it ions which could affect the other crew 
or spacecraft. it is planned to improve romimin ica t ions by 
usino ATS-F but no continuency action is planned if it is 
not available. :'dadan provider, t.be primary communications 
ooveraue and exceeds the minimum rei|u i rement s for ASTP. 
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I’ in.il ly, in rosipoi. n In tin* Panel «|ue::l i<>n on sumuk 
oirouil .lint (null eurrnn. nnuly son, t lin:n* are boiiiu 
uooompl inhod on both tin* CSM nmi bM/dookina uyslum. 

Tin* Panel nxprnswnd n s;| mini mnomiunnd.it inn I hut I In* 

Sky I nh nxpnr inline In* utilised In I In* maximum dnarnn 
posm.ibln nn nun nnt pt'earnm:;. Skylab has; almost nnm~ 
pleted tin* publinntinn of n .sorins; ol " Pensions'. l.ouruod" 
donuninnl :t . My oflion, on M.n oh l , 1 *> 7 -1 , levied .in 
nnl inn item on nanli Pioaram nil inn In review t henn donu- 
mnnt n mut report bank to mn on imol ninnnt at i on of t ho sin 
" lo:;son;i loarnod.'' I will mnko t hone responses*. available 
to tin* PannL upon their rnnnipt. __ 

Sianifieant rosiponsosi l rom l tn* Spann Shut tin Oflion tvl.Hn 
to VnluiiK* I, pa*i*'*i l.' t limuah It*, and Vo I unu* II, panes 1 , 
>'*, -I ,*t atnl I 1 * t hromih 17, In tin* arna m‘ tin* Panel's; 
nnnnnni about intooral ion an! i v i I ins', ot ilookwo 1 l , JSC has; 
nivon a tas'.k t o tin* nont motor to look at nopnrnliini thnir 
i n t on ra l i on function I rom tin* Orbilnr tank (dun May 41). _ 

t n tin* arna o l smlvaiit r.U’l rr vendor non! ml , Kookwo I 1 is* 
rnwril imj lln*ir I’ronurninmi I Mananomunt Plan with a now 
omphastis on common.! I i l y manaaosuont (expected by Juno 1*174)., 
In in:i|’Oi;;n to tin* ooiu’i’rn with weinhl oontrol, a eombin- 
ation otlort ot s'driot wniiinl nonlrnl measiures*., a specific 
Orbilnr weinhl reduction anl ivitv, and a stories'. of avnrall 
wo i a It l and portormanoo l radn-rt I am bnimt punumd. In 
llit* n.ma ot aboi I ro.pi i remon t s; , ront inuin.i at toil ion is; 

! >t ■ i a. | pa i d l o do t n rm i iu* abort na pab i I i l i os*, for tin* va r i oust 
m i s'.ss i (Mi phasic;; lor tin* desman whii*h is; ovolvinu t ri’iu l Iu* 
drivina roi|U i t croenl «*. of opi'i al itMial unoss. Tin* Panel 
I’Xprt's.su’d I'omvrn in tin* Avionics; arna bivamm limy toll 
that I In* ;;y;dom:: worn on tin* 1 n.ni i no edne al t 1m r.talo-ol- 
I In* art. Tin* ii’spomu* indinalt's; that t Iu* pm. Iran has: a 
hundlo imi I ho dnsiian so I u t i mis . Spt'i* i • i on I I y , nxpi’tiniuv 
i'n both liardwan* and ct'l Ivan* 'or a Pnrlorntanoo Mon i t or i na 
S\ ‘ . I om has; boon . ;a i in*. I at I I so M i s a i on Con I m 1 Con t o I . 

Mood i ud> u’sni'n I a bn nod or. these experiences; will be exer- 
cised to ki'np t opu i i omon l s mn nuno.tbl e . Similarly, tin* 
Autoload Sy s I on is bo ma vi't v enrelnlly di*s:i.im'd ussina 
I ho In unpowotod automat in aopmanhos and landin*::'- with 
tin* CV n*io ns .in oM-oriouoo base. Also boina usod is. 
ppoi i y Knud with l ho i r (‘V *'•*«> lost pmaian rxpri irnor. 

1-. till inaaids to i 'no man i n l no loop voi suis*. automated 
svdons, an approach ol usinn aulom.it io tnnol ion:; lor 
ox pons i vn and soph i si > on I o. sy si . -ris who vo si * 1 i I second 
di’oisioiis; am required is boiim I o I I owed . This is: borim 
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nut by 7-17 .iirnr.il l ur.n of Auto land for consistent low u 
luudinqs in all weather. Turnaround limn in oi *1 * *'♦' 1 ‘* oU ~ 
corn and its reeo.ivinq full attention of a panel woik.inq 
witli latent -Ionian, logistic ami maintainability informa- 
tion an it becomes available. The eoneorn about all -went he; 
capability in being worked both with reuardn to oi foots on 
the TPS and on Avionics;, It may be necessary, however, to 
aacri f ice some all-weather charactori nt ion tor thermal 
characteristics on the 'ITS. operational alternator, are 
available since chances of bad weather at both piimo and 
cent inuoney landinu niton is; very low. In addition, auto- 
matic land inn and overrun equipment in being installed to . 
bettor handle all weather problems. On the SSMl* Controller 
the Panel hud questioned the reasons for not considering a 
magnetic core memory. The response lists a series ol 
reasons t or not usinn the core approach but also .indicates 
that, an MSI'C committee is reviewing t ho whole eont roller 
development problem with a report to .ISC due on May 1°7 

The Panel felt that test oroani r.ations at Rockwell were not 
yet firmly established. This area has since been siunifi- 
oantly improved and staffed, including uovornment. voles and 
responsibilities for most of the test sites. On the TPS 
the Panel correctly pointed out that major desiun issues 
include strain, isolation, adhesives, joints, TPS/fuel 
compatibility, dynamic seals and development ol a 100- 
mission life coal i mi . In response, an up-to-date status 
of development testing on each ol these desiun issuer, is 
provided in l ho attached detailed answers. On the s;. Ml., tin 
chains' to Mi I -ll-iM .'0 hydraulic fluid caused some questions 
on possible i art her evaluation required. In response, 
materials in contact with the tluid arc beinu identified 
and materials compat i bi 1 i t y is beinu reviewed (including 
POP testinu and service experience). In addition, an 
accept unco and desiun ver i I' icul ion prourum is beinu 
initiated to tost eomponent s and systems with Mi 1 — H — 

Si.'!?.’ fluid. The Panel a I so questioned whether the :h?Mi: 
ilex line material was compatible with oxvuen and not sub- 
jo, -t to hydrouen embr i t t lemon I . This is; a we l 1 - roeoun i rod 
problem and the materials have boon selected accord i mil y. 
The Panel pointed out the ditlerenl requirements lor the 
oombus I ion ehambor as- rampai od to tin* .1-.’ onqino. 

The response indicates that the Nuriev material was select* 
to best meet I lie unique requirements ol hiuh thermal con- 
duct i v i l y , h i qh st remit h ami duel i I i t y , hi >ih met a I in u i ca l 
stability and tile charade! isl ics. Allhouuh the Panel 
next pointed out that the optimum technique lor reentry 
has not been del hunt, the response indicates that much 
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yi n.t tumu'l data , fliqht r.iiuul .itionn , at' rot henna 1 dynamics 
work, etc. which is in proqress may cause many chanties and 
l lie technique may well have to ho developed from opera - _ 
t.ional phase experience. The 1'anel also questioned 
adequacy of controls Cor qualification of "of f-tho-shelf " 
hardware. A special hovel TI hirective was deemed 
neeessary to insure adequate controls and it is in the 
final review/approval cycle, Finally, the Panel's concern 
for effective measures to prevent stress corrosion was 
recoqnizod early by the Shuttle Proqram and is controlled 
by a NASA materials and process specification, including 
a contractor materials control and verification plan, 
which incorporates material siqn-off of drawinns and 
records of all deviations with rationale for each. 

in conclusion , l would like to thank the Panel foi. its. 
thovouqh and excellent report and assure thorn that their 
thou'qhtful questions are continuinq to provide an excellent 
checklist for our proqram mnnnqemcnt function. 

V ) ' /' M . / ' / / / ;t(< 

John F. Vnrdley (' 

Attachments 
as stated 
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7,4 KSC/MSFC M1M) OF UNDERSTANDING 


KRW i°sa.7/sp 

October 10, 197U 

— Effective Dole 


JOHN F. KENNEDY SPACE CENTER, NASA 
MANAGEMENT INSTRUCTION 


etio ici'T K-qr/MSFC MEMORANDUM OF U NDERSTANDI NG FOR 

SUBJECT AlTTANinEtTXND SOLID ROCKE T 

BOOSTERlSRB) support equipment 

1. PURPOSE 

This Instruction incorporates into the KSC Issuance System a 
Memorandum of Understanding between the John F. Kennedy Space 
Center NASA (KSC) and the George C. Marshall Space Flight 
Center’ (MSFC) for Shuttle External Tank (ET) and Solid Rocket 

Booster (SRB) support equipment T ^ s e 

itotne of mmoort eauipment for the Shuttle hxternaj. jamt 

and Solid Rocket Booster which will be the responslbiUty of KSC 

and those items which will be the responsibihty of MSFC. 



R. C. Hock 

a rtf F.vorutive Staff 


Attachment: 

A. Memorandum of Understanding 

Distr ibut ion : 

STDL-P 
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ATTACIIMKNT A to 
KM I 1058,7/SP 

ET and SRB SUPPORT EQU IPME NT 

MEMO OF UNDERSTANDING 

7 > 1 (» 7H 

1. Support equipment has been defined in three categories: 

Ground Support Equ ipment (GSE) : 

GSE consists of that equipment and associated software which is 
required to check out, service, ha die, provide access to, maintain 
and safe the External Tank, and Solid Rocket Booster, their sub • 
assemblies or other system elements at the launch and landing sites 
only. Includes such items as: 

o Fixed facility access stands, horizontal and vertical 

o Facility support and storage stands 

o Purge and pressurant gas supplies and consoles 

o Ground ECS 

o Launch processing system and associated software 
o Launch site electrical and mechanical BME 
o Standard test equipment 

o Standard power supplies and battery GSE 

o Ground transiwrtation prime mover 

o Facility leak detectors 

Special Test Eouipment (STE): 

STE consists of that equipment and associated software which is 
required to support checkout, development, and qualification testing 
of the External Tank, and Solid Rocket Booster, their subassemblies 
or other elements during manufacturing buildup and development. 
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Includes such items as: 

o Internal access platforms 

o Special test cable kits and boxes 

o Other equipment with an intimate design interface with 
the flight hardware 

Transportation and Support Equipment (TSE) : 

TSE consists of that hardware which is required to transport 
handle, and maintain the External Tank and Solid Rocket Booster ’ 
their system elements to and from the contractor's facilities other 
government facilities, and to and from the launch site and landing 
sites (s) exclusive of tooling used within the factory and commercial 
conveyance equipment. Includes such items as: 

o Transporter 

o LRU handling slings and dollies 

2. The selected contractor will furnish all materials and services 
to design develop, test, qualify, manufacture, assemble, check out 
and maintain the STE and TSE. Checkout and maintenance at the 
launch site is excluded. 

3. The contractor will identify those items of, and concepts for, 

ET or SRB support equipment recommended for use at the launch site. 

4. The contractor will analyze specified and potential launch site 
requirements in the design of STE and TSE from a program cost 
effectiveness viewpoint in order to maximize commonality. This 
analysis shall show the design/cost savings or impact of commonality. 

5. The contractor’s incorporation of unique launch site requirements 
in STE and TSE shall be approved by the NASA Project Office for 
accomplishment under an existing ET or SRM procurement or shall 
be accomplished through a supplemental contract arrangement 
negotiated and managed by the launch site on a case -by case basis. 
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«>, T1h> selection of nininmn equipment and the identifieation <»f launch 
site requirements will ho iho responsibility of KSC. I he ilcsinn ami 
development of this common equipment will he controlled by a eo- 
eliair man ship of one KSC Support Equipment Manager and one MSFC 
Manager appointed hy the FT or SRH Project Manager, Neither of 
the co-chairmen would have unilateral authority to proceed with indepen- 
dent development or make changes to this - omrnon support equipment; 
however, generally the MSFC Manager will he the leading element with 
the KSC Manager concurring in planned direction or changes. Both 
Managers will have ready access to the contractor for day-to-day 
technical discussions and problem resolution; however, the MSFC Manager 
will initiate all formal direction of the contractor. If a disagreement 
develops between the co-chairmen that could impede the progress of 
the common equipment development, the matter will be immediately 
brought to the attention of the appropriate Project or Projects Office 
Managers at MSFC and KSC, 

7. The design and development of STK. TSK, and common support 
equipment is included in the present FT and SUM procurement; however, 
the specific units of this equipment that are required for sole use at the 
launch site will he funded hy KSC. 

8, The design/procuremenl /fabrication of C1SF is excluded from the 
present FT >iul SUM procurements and will he covered under a separate 
procurement action to be negotiated, managed, and funded by the 
launch site. 

If, during the design or development of common usage support 
equipment, an item evolves to the point that it is no longer cost effective 
for the program to maintain common usage, then separate design/ 
development actions will he initiated. From this point, the equipment 
would he classified as STK, thereby placing it under sole MSFC manage- 
ment and budget control; or as C.SF, thereby placing it under sole KSC 
management ami budget control. 



MAJOR ORBITER SUBCONTRACTORS 
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AEROJET I I MARQUARDT 











7 , (• S PACK SIHITT1.F. ilYSTKM 1‘KKI.IMI .NAKV l> K: » l> ~,N KKV I I.W 
I il l joe I 1 V OS 

Tin' purpose ni (hi* S.SS-PPR is in conduct .in end i o-eml r view in 
assure ili.it (lu* Spnro Shuttle System level roqu f reinent h will be sat is- 
i ii'il by current hardware ami software design ami planning. The system 
love l aspects of the element programs will bo examined, including the 
Orbit er, External Tank, Solid Rocket booster, Spare Shuttle Main En- 
gine, l’ayload Aceoramodat ions and Cround Systems. The object iv 'S to 
be accomplished during the PllR are to: 

(a) Review the total Space Shuttle System desigr, includ- 
ing as required, individual elements, payload aeeoiiuiiod.it ions and the 
ground systems to assure compliance with Space Shuttle System require- 
ments . 

(bl Review current hardware and software design and pre- 
dicted capability as compared with mission requirements. 

(e) Review current designs and plans against quality, re- 
liability, maintainability and salety requirements. 

Review Items 

At the PllR, the participants will be expected to review various 
data which describe the system design. These data will include (1) 
documents (plans), (.’) drawings ami schematics, (t) inaim factoring and 
test layout and flows, ami (u> other b,uk-np data. 


Review Operations 


Review Tennis . The reviews will be accomplished by teams that 
have the responsibility Cor reviewing assigned areas. A team cap- 
tain has been assigned to each of the major technical areas to be 
reviewed. Each team captain will be responsible to the review chair- 
man for nominating the members of the team necessary to accomplish 
an adequate review of his assigned area. Each review team should in- 
clude the NASA technical area manager and support personnel, flight 
and ground operations personnel, project element representatives as 
appropriate, and contractor representatives as required. 

In accomplishing the review objectives, each team prepares Re- 
view Item Dispositions (RlD's) to describe significant discrepancies 
and inconsistencies. Each team captain reviews all RID's generated 
by his team to eliminate redundancies and duplicate RID's. The team 
captain submits the team findings and recommended RID dispositions to 
the review coordinator in the form of a team review packaging con- 
sisting of (1) a set of team minutes, and (2) all RID's written by the 
team. The team captain has the overall responsibility for all activity 
of his team and assure that all review ground rules and schedules are 
met. He prepares -he appropriate response to each RID and recommends 
the disposition to be taken. 

Review Item Disposition (RID's) 

RID's shall be submitted to .he review control station as soon 
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its they are writ ion to allow as much l Into an possible tor processing. 
Kvery attempt will he made to resolve problems via the review teams 
during the team meetings. 

ocroeninK Group . Fro -board and Hoard Operations 

Screening Group . The screening group will screen all Rill's sub- 
mitted to avoid redundancy, duplication, or other programmatic problems 
that may be generated. This group will review the disposition ol all 
RID* s and categorise them for review by the pre-board. 

Pro -Board . The pre-board will be responsible lor reviewing all 
Rill's, with primary emphasis on those Items requiring turther de- 
liberation or resolution. Alter the pre-hoard review, Rill's ot major 
Importance will he lorwarded to the board lor l Inal review and dls- 
pos l t Ion . 

Board ■ The hoard is the l Inal di sposi t lotting authority. All 
Rip's ot major Importance to the program will he d isposit toned at 
this level. Board presentations will consist ol project sunmnrles 
bv each project manager and Individual summaries by the team leaders 
ol review accomplishments, problems, matters ol sign it leant impor- 
tance and RIP's. 
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jSt: SYSTKMS tNTKCKAT* ION UITUT. FUNCTIONS 


PRIMK 


ASCKNT N KNTRY PKRKORMANCK 
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KLIOIIT CONTROL 
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RKLIAPI I.ITY 

SAKKTY 

QUALITY ASSURANCK 
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SCA SYSTKMS 

SCA SYSTKMS SUPPORT' 


SUPP ORT' 


ARC 1 1.1 ARY HARPWAKK Kl-'.qU I RKMKNTS 
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CIIANOl- ASSKSSMKNT 

CONK I OU RAT ION MANAOKMKN Y 
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TABLE H 


PANELS AND WORKING GROUPS 


MANAGEMENT 


PEREORMANCE MANAGEMENT PANEL 
CONFIGURATION MANAGEMENT SYSTEMS PANEL 
MIC INTEGRATION PANEL 
INFORMATION MANAGEMENT SYSTEMS PANEL 
INTEGRATED LOGISTICS WORKING GROUP 
COST PER FLIGHT COMMITTEE 
SCHEDULE/LOG 1C INTEGRATION WORKING GROUP 


TECHNICAL 


SYSTEM INTERFACES PANEL 
FLIGHT PERFORMANCE PANEL 
LOADS/ STRUCTURAL DYNAMICS PANEL 
INTEGRATED PROPULSION f* FLUIDS PANEL 
FLIGHT CONTROL SYSTEM PANEL 

ORBIT ** ENTRY ECS SUHPANKL 

GUIDANCE NAVIGATION K CONTROL SYSTEMS SUBPANEL 
ASCENT FCS/ STRUCTURES SUBPANEL 
INTEGRATED avionics panel 
MECHANICAL SYSTEMS PANEL 

SPACECRAFT SYSTEMS SUHPANKL 
AIRCRAFT’ SYSTEMS SUHPANKL 
GROUND SYSTEMS INTEGRATION PANEL 


ROLKWKLL 1NTKRNAT10NAL 1 S SYSThMS INTKORATION TASKS 


Mill mi! PROGRAM PKl'tN IT I ON AND RKQll f RKMKNTS 
SYSTKM INTKRKAOK CONTROL 
MASS PROPKRTIKS 

Ki.nm r systkm dksion pkriormanok 

0 ROUND OPKRATIONS ANALYSIS 
LOST PKR I'Ll Oil l’ 

1NTKORATKD SOIIKMATIOS 
MASTKR MKASltRKMKNT LIST 
1NTKORATKD VKIIIULK ANALYSIS 
INTKORVl'KP OKOUNP TKST 
LON K I OURAT I ON MANAOKMKNT 

program soiikpulk 

MANAOKMKNT INFORMATION OKNTKRS 
COMMONALITY P ROOK AM 
LOO 1ST l OS 

QUALITY MANAOKMKNT 
SAKKTY AND RK1. lAHl 1,1 TV 
PRKKLIOIIT AND 1'LIOHT I’KST SUPPORT 
INI'KRKAOK TOO LI NO 

SYSTKMS MATK RIALS ANI> PROOKSS CONTROt 
PAYLOAD INI'KRKAOK 
MISSION PLANNINil 

KKPRKSKNTATI VKS A I' 1 1 1 MKN |‘ CONTRACTORS 
SYSTKM I.KVKI. WORKINO CROUPS 
RKPRKSKN I’A I VKS AT NAS A OKNTKRS 
SPKOIAI. STUD IKS 


TABLE 1 7 

PRESENT 0RL1TER BASELINE 
FUIJCT I Of l/CR 1 T I CAL I TY SUIiMARY 












ORBITER Ol'KRATIONM. MODES 


Manual Direct 

The crew manually controls the vehicle. No feed-back r^gnals 
iroin vehicle-motion sensors are used for stabilization and control. 

The crew's conmand signal is applied to the appropriate force effec- 
tor via the ONSC computer. Required compensation and logic for 
effector selection are accomplished within the ttNNC computer. Ve- 
hicle-motion signals are displayed as required for crew operation. 
Automatic OSN commands are inhibited. 

Manual Command Augmentation 

The crew manually controls the vehicle as in manual direct. How- 
ever, ;he crew's command is augmented by feedback signals from vehicle- 
motion sensors to improve response or augment stability, or both. Re- 
quired compensation and logic for el lector selection are accomplished 
within the computer. Vehicle-motion signals are displayed as re- 

quired for the crew. Automatic U\N commands are inhibited. 


Hold 


The controlled vehicle parameter is held at the value existing 
when the hold function is engaged. Tit is relerence signal is not alter- 
able by (he automatic guidance system except by disengagement and re- 
engagement of the hold function. The old function may be manually dis- 
engaged by moving the associated manual hand controller from the detent 
position. Reengagement is accomplished by returning the hand controller 
to (lie detent position. 


So lee l 

Hie coat colled vehicle parameter converges to and holds the value 
selected or preselected by the crew. 


Au i oma t i c 

The guidance luuel ion provides automatic control ot the vehicle. 
Manual command signals are inhibited and cannot act to sum with or over- 
ride the automatic conmand s 1 rorn the guidance system. Vehicle motions 
signals are displayed to permit crew monitoring ot the ONN I unction. 

Hie e tew has the option ot manually engaging or disengaging the autu- 
mn tic l line l 1 on . 


TABLE VI 


ATMOSPHERIC REVITALIZATION SUBSYSTEM 

FUNCTIONS 

CARBON DIOXIDE, ODOR, AND WATER VAPOR CONTROL IN PRESSURIZED CABIN 

CABIN PRESSURE MAINTENANCE AND CONTROL 

CABIN ATMOSPHERE THERMAL CONTROL 

CABIN AND AFT SECTION AVIONICS THERMAL CONTROL 

ATMOSPHERIC REVITALIZATION FOR HABITABLE PAYLOADS (WHEN REQUIRED) 
DESIGN/PERFORMANCE REQUIREMENTS 
MISSION 

- NOMINAL: 42 MAN-DAYS 


EXTRAVEHICULAR ACTIVITY: 3 TWO-MAN PERIODS 




► 
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I 
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TABLE VIII 


TYPICAL CONTROLLER ELECTRONICS CARD FAILURE RATES 


Nomenclature 
Output electronics 

Quantity 

1 

Failure R.ite 
1771000 hr.) 

Percent of Controller 
Failure Rate 

0.597 

1.7 

Power supply 

1 

0.455 

1.3 

Input electronics 

1 

0.310 

0.88 

Computer interface 
electronics 

2 

0.208 

0.59 
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TABLE IX 


CONTROLLER 

RELIABILITY PREDICTION 

Assembly 

Failure Rate 
7 , ner 1000 hrs 

Input Electronics 

3.96 

Interface Electronics 

2.87 

Output Electronics 

3.32 

Power Supply and Chassis 

2.30 

DCU 

21.18 

Controller 

33.63 


3,000 hours MTFK 
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SHUTTLE SYSTEM CONCERNS 
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T-0 UMB I LI CAL DOOR 
THERT1AL HISTORY 



0V-102 PDR (ENTRY - 14040) 




FORWARD RCS 



Figure 



THERMAL PROTECTION SYSTEM DESCRIPTION 
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THERMAL SEAL CONCEPTS 



Figure 10 







TPS GEOMETRY TOLERANCE 







ORBITER AVIONICS SUBSYSTEM 
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ORBITER ELECTRICAL POWER SUBSYSTEM 
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ELECTRICAL POWER SYSTEM 





Q 


CO 


LA 




o 


CO 

O 


< 




d? 




j= 


vD 

i—t 


sy 


Ll, 

o 

3 


i-H 


a 

2 

OQ 

| 

O 

In 

te 

oo 

m 


CO 

< 

Q£ 

O 

H- 

st> 

1 

o 

p»- 

» ** 
rt 

sO 

< 

Q_ 


CM 

» 


o 

* 

LU 

CO 


_l 

< 

>- 

}— 

£21 

o' 

CO 

LU 

M 

LU 

NJ 

CO 

LU 

cn 

£ 

< 

< 

ID 

CO 

u 

1 

< 

Q 

o 

t 

< 

£ 

o: 

LU 


O 

to 


5 

Q_ 


CQ o 

2 ! I— 
O Q 


NJ ^ UJ 
<r ;=; oq 


O 


BRAZE 

ROCKWELL 

INTERNATIONAL DYNATUBE-RESI STOFLEX 

APOLLO 

Figure li 




Figure 16 






CONTROLLER ORGANIZATION 
AND REDUNDANCY 







CONTROLLER ELECTRONICS ARRANGEMENT 



Figure 20 









SFACE SHUTTLE POGO ACTIVITIES 



Figure 22 
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HBMA1IC MCKAtt 


POGO SUPPRESSION ACCUMULATOR 
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Figure 24 


EXTERNAL tank 



Figure 25 



Leak-Bcfon-FaUurt Dttign 

















































THE GEY SEEING EFFECT 



Figure 30 
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POINT SENSOR PROPELLANT GAUGING SYSTEM 
BASELINE CONFIGURATION 
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Figure 35 
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Case Design Configuration 



Figure 41 
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RANGE SAFETY 
BASELINE SYSTEM 



Figure 53 
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MAJOR GROUND TEST PROGRAMS 
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SPACE SHUTTLE MAIN PROPULSION SYSTQl 
(SCHEMATIC) 



Figure 58 
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